CVE-2001-1369

The CVE-2001-1369 issue affects pam-pgsql prior to 0.5.2. It allows remote attackers to bypass authentication or modify user records by injecting SQL into the user or password fields, thereby executing arbitrary SQL. Root cause is SQL injection in authentication-related input. The provided docume...

Important: Red Hat Security Advisory: : : : Updated PAM packages fix bug in pam_xauth module

Updated PAM packages are now available for Red Hat Linux 7.1, 7.2, 7.3, and 8.0. These packages correct a bug in pamxauth's handling of authorization data for the root user. Updated 16 April 2003 Added packages for Red Hat Linux on IBM iSeries and pSeries systems. The pamxauth module is used to...

OPENSSH REMOTE ROOT COMPROMISE ALL VERSIONS

-----BEGIN PGP SIGNED MESSAGE----- OPENSSH REMOTE ROOT COMPROMISE ALL VERSIONS MICKEY MOUSE HACKING SQUADRON ADVISORY 2 DISCLAIMER - ---------- The nation's zeroth private security intelligence firm, Mickey Mouse Hacking Squadron uniquely addresses the challenges faced by both public- and...

CVE-2002-2098

Buffer overflow in axspawn.c in Axspawn-pam before 0.2.1a allows remote attackers to execute arbitrary code via large packets...

CVE-2002-1227

PAM 0.76 treats a disabled password as if it were an empty null password, which allows local and remote attackers to gain privileges as disabled users...

[SECURITY] [DSA 177-1] New PAM packages fix serious security violation in Debian/unstable

-------------------------------------------------------------------------- Debian Security Advisory DSA 177-1 [email protected] http://www.debian.org/security/ Martin Schulze October 17th, 2002 http://www.debian.org/security/faq -...

[SECURITY] [DSA 177-1] New PAM packages fix serious security violation in Debian/unstable

-------------------------------------------------------------------------- Debian Security Advisory DSA 177-1 [email protected] http://www.debian.org/security/ Martin Schulze October 17th, 2002 http://www.debian.org/security/faq -...

pam - serious security violation

A serious security violation in PAM was discovered. Disabled passwords i.e. those with '' in the password file were classified as empty password and access to such accounts is granted through the regular login procedure getty, telnet, ssh. This works for all such accounts whose shell field in the...

CVE-2002-0640

Buffer overflow in sshd in OpenSSH 2.3.1 through 3.3 may allow remote attackers to execute arbitrary code via a large number of responses during challenge response authentication when OpenBSD is using PAM modules with interactive keyboard authentication PAMAuthenticationViaKbdInt...

DEBIAN-CVE-2002-0640

Buffer overflow in sshd in OpenSSH 2.3.1 through 3.3 may allow remote attackers to execute arbitrary code via a large number of responses during challenge response authentication when OpenBSD is using PAM modules with interactive keyboard authentication PAMAuthenticationViaKbdInt...

How to reproduce OpenSSH Overflow.

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 The R7 team did a little investigating into one of the OpenSSH vulnerabilities. The following are instructions on how to reproduce a segmentation violation in sshd v3.2.3p1: 0. Compile with PAM and S/KEY support. 1. Apply the following patch to the ss...

[SECURITY] [DSA-134-4] OpenSSH Remote Challenge Vulnerability

Package : ssh Problem type : remote exploit Debian-specific: no CERT advisory : CA-2002-18 This advisory is an update to DSA-134-3: this advisory contains updated information that is relevant to all Debian installations of OpenSSH the ssh package. DSA-134-4 supersedes previous versions of DSA-134...

[SECURITY] [DSA-134-3] Unknown OpenSSH remote vulnerability

Package : ssh Problem type : remote exploit Debian-specific: no This advisory is an update to DSA-134-2: the changes mainly deal with packaging issues; if you have already successfully installed an openssh package from a previous DSA-134 advisory you may disregard this message. Theo de Raadt...

OpenSSH vulnerabilities in challenge response handling

Overview There are two related vulnerabilities in the challenge response handling code in OpenSSH versions 2.3.1p1 through 3.3. They may allow a remote intruder to execute arbitrary code as the user running sshd often root. The first vulnerability affects OpenSSH versions 2.9.9 through 3.3 that...

CVE-2001-1147

The PAM implementation in /bin/login of the util-linux package before 2.11 causes a password entry to be rewritten across multiple PAM calls, which could provide the credentials of one user to a different user, when used in certain PAM modules such as pamlimits...

CVE-2001-1147

CVE-2001-1147 affects util-linux’s /bin/login PAM handling prior to version 2.11, where a static pwent buffer could be rewritten across PAM calls. In non-default configurations (notably with pam_limits), this could leak one user’s credentials to another. The advisories (Mandrake, Red Hat) documen...

Privelege escalation via SuSE shadow/pam-modules

No description provided...

Format string bug in pam_ldap/squid_auth_ldap

Format string bug on syslog call...

ldap vulnerabilities

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 - --- Blackshell Advisory 5 --- Local Format String Vuln in pamldap and remote in squidauthldap - --- Blackshell Advisory 5 --- - --- Versions Affected --- pamldap: 143 prior vendor status: nil squidauthldap: 2.0 prior vendor status: nil - --- What is...

CVE-2001-1190

CVE-2001-1190 concerns Mandrake Linux 8.1 where the default PAM files used by the passwd program do not support MD5 passwords. The root cause stated in connected advisories is the lack of MD5 support in the default PAM configuration, which can yield weaker password security than intended. The evi...