SuSE 11.3 Security Update : pam (SAT Patch Number 9119)

This update changes the broken default behavior of pampwhistory to not enforce checks when the root user requests password changes. In order to enforce pwhistory checks on the root user, the 'enforceforroot' parameter needs to be set for the pampwhistory.so module. This pam update fixes the...

DEBIAN-CVE-2013-7041

The pamuserdb module for Pam uses a case-insensitive method to compare hashed passwords, which makes it easier for attackers to guess the password via a brute force attack...

CVE-2013-7041

CVE-2013-7041 affects the Linux-PAM pam_userdb module, where a flaw in the password hash comparison (notably using case-insensitive comparison via strncasecmp) can enable brute-force credential guessing. Reported across multiple vendors (IBM FSM, Red Hat, SUSE, Debian/Ubuntu advisories) with low-...

CVE-2013-7041

The pamuserdb module for Pam uses a case-insensitive method to compare hashed passwords, which makes it easier for attackers to guess the password via a brute force attack...

CVE-2013-7041

The pamuserdb module for Pam uses a case-insensitive method to compare hashed passwords, which makes it easier for attackers to guess the password via a brute force attack...

CVE-2013-4285

A certain Gentoo patch for the PAM S/Key module does not properly clear credentials from memory, which allows local users to obtain sensitive information by reading system memory...

Design/Logic Flaw

A certain Gentoo patch for the PAM S/Key module does not properly clear credentials from memory, which allows local users to obtain sensitive information by reading system memory...

CVE-2013-4285

The CVE concerns Gentoo’s patch to the PAM S/Key module that fails to clear credentials from memory. A local attacker with privileged access could inspect memory dumps to obtain cleartext credentials. Affected software is the PAM S/Key module used by Gentoo; the underlying issue is that credentia...

CVE-2013-4285

A certain Gentoo patch for the PAM S/Key module does not properly clear credentials from memory, which allows local users to obtain sensitive information by reading system memory...

'pam_cifscreds' PAM模块'cifskey.c'栈缓冲区溢出漏洞

Bugtraq ID:65743 CVE ID:CVE-2014-2830 pamcifscreds是一个PAM模块。 pamcifscreds 'cifskey.c'存在一个基于栈的缓冲区溢出，允许攻击者利用漏洞可使应用程序崩溃，或者可以应用程序上下文执行任意代码。 0 pamcifscreds 目前厂商已经发布了升级补丁以修复漏洞，请下载使用： https://bugzilla.novell.com/showbug.cgi?id=870168...

Fedora Update for oath-toolkit FEDORA-2014-2875

Check for the Version of oath-toolkit OpenVAS Vulnerability Test Fedora Update for oath-toolkit FEDORA-2014-2875 Authors: System Generated Check Copyright: Copyright C 2014 Greenbone Networks GmbH, http://www.greenbone.net This program is free software; you can redistribute it and/or modify it...

CVE-2011-3628

Untrusted search path vulnerability in pammotd aka the MOTD module in libpam-modules before 1.1.3-2ubuntu2.1 on Ubuntu 11.10, before 1.1.2-2ubuntu8.4 on Ubuntu 11.04, before 1.1.1-4ubuntu2.4 on Ubuntu 10.10, before 1.1.1-2ubuntu5.4 on Ubuntu 10.04 LTS, and before 0.99.7.1-5ubuntu6.5 on Ubuntu 8.0...

DEBIAN-CVE-2011-3628

Untrusted search path vulnerability in pammotd aka the MOTD module in libpam-modules before 1.1.3-2ubuntu2.1 on Ubuntu 11.10, before 1.1.2-2ubuntu8.4 on Ubuntu 11.04, before 1.1.1-4ubuntu2.4 on Ubuntu 10.10, before 1.1.1-2ubuntu5.4 on Ubuntu 10.04 LTS, and before 0.99.7.1-5ubuntu6.5 on Ubuntu 8.0...

[SECURITY] Fedora 20 Update: oath-toolkit-2.4.1-3.fc20

The OATH Toolkit provide components for building one-time password authentication systems. It contains shared libraries, command line tools an d a PAM module. Supported technologies include the event-based HOTP algorithm RFC4226 and the time-based TOTP algorithm RFC6238. OATH stands for Open...

CentOS Update for samba4 CESA-2014:0383 centos6

The remote host is missing an update for the SPDX-FileCopyrightText: 2014 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

CVE-2014-2583

Multiple directory traversal vulnerabilities in pamtimestamp.c in the pamtimestamp module for Linux-PAM aka pam 1.1.8 allow local users to create arbitrary files or possibly bypass authentication via a .. dot dot in the 1 PAMRUSER value to the getruser function or 2 PAMTTY value to the checktty...

CVE-2014-2583

Multiple directory traversal vulnerabilities in pamtimestamp.c in the pamtimestamp module for Linux-PAM aka pam 1.1.8 allow local users to create arbitrary files or possibly bypass authentication via a .. dot dot in the 1 PAMRUSER value to the getruser function or 2 PAMTTY value to the checktty...

Directory traversal

Multiple directory traversal vulnerabilities in pamtimestamp.c in the pamtimestamp module for Linux-PAM aka pam 1.1.8 allow local users to create arbitrary files or possibly bypass authentication via a .. dot dot in the 1 PAMRUSER value to the getruser function or 2 PAMTTY value to the checktty...

CVE-2014-2583

CVE-2014-2583 is a vulnerability in the pam_timestamp module of Linux-PAM (pam) 1.1.8 where a crafted ".." in PAM_RUSER or PAM_TTY to format_timestamp_name enables local users to create arbitrary files or potentially bypass authentication via directory traversal in pam_timestamp.c (get_ruser/chec...

CVE-2014-2583

Multiple directory traversal vulnerabilities in pamtimestamp.c in the pamtimestamp module for Linux-PAM aka pam 1.1.8 allow local users to create arbitrary files or possibly bypass authentication via a .. dot dot in the 1 PAMRUSER value to the getruser function or 2 PAMTTY value to the checktty...