DEBIAN-CVE-2004-1340

Debian GNU/Linux 3.0 installs the libpam-radius-auth package with the pamradiusauth.conf set to be world-readable, which allows local users to obtain sensitive information...

DEBIAN-CVE-2005-0108

Apache modauthradius 1.5.4 and libpam-radius-auth allow remote malicious RADIUS servers to cause a denial of service crash via a RADIUSREPLYMESSAGE with a RADIUS attribute length of 1, which leads to a memcpy operation with a -1 length argument...

CVE-2004-2396

passwd 0.68 does not check the return code for the pamstart function, which has unknown impact and attack vectors that may prevent "safe and proper operation" of PAM...

Debian DSA-025-2 : openssh - Missing PAM support

A former security upload of OpenSSH lacked support for PAM which lead to people not being able to log onto their server. This wasonly a problem on the sparc architecture. We recommend you upgrade your ssh packages on sparc. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text...

Debian DSA-134-4 : ssh - remote exploit

ISS X-Force released an advisory about an OpenSSH 'Remote Challenge Vulnerability'. Unfortunately, the advisory was incorrect on some points, leading to widespread confusion about the impact of this vulnerability. No version of OpenSSH in Debian is affected by the SKEY and BSDAUTH authentication...

Debian DSA-177-1 : pam -- serious security violation

A serious security violation in PAM was discovered. Disabled passwords i.e. those with '' in the password file were classified as empty password and access to such accounts is granted through the regular login procedure getty, telnet, ssh. This works for all such accounts whose shell field in the...

Debian DSA-388-1 : kdebase - several vulnerabilities

Two vulnerabilities were discovered in kdebase : - CAN-2003-0690 : KDM in KDE 3.1.3 and earlier does not verify whether the pamsetcred function call succeeds, which may allow attackers to gain root privileges by triggering error conditions within PAM modules, as demonstrated in certain...

Debian DSA-370-1 : pam-pgsql - format string

Florian Zumbiehl reported a vulnerability in pam-pgsql whereby the username to be used for authentication is used as a format string when writing a log message. This vulnerability may allow an attacker to execute arbitrary code with the privileges of the program requesting PAM authentication...

CVE-2002-1227

PAM 0.76 treats a disabled password as if it were an empty null password, which allows local and remote attackers to gain privileges as disabled users...

CVE-2002-1227

PAM 0.76 contains a vulnerability: disabled passwords are treated as empty (null) passwords, allowing local and remote attackers to gain privileges for disabled users. The Debian advisory DSA-177 notes the issue is fixed in PAM package versions 0.76-6 for Debian/unstable; other distributions are ...

CVE-2002-1160

The CVE-2002-1160 issue concerns the pam_xauth module, where the default configuration forwards MIT-Magic-Cookies to new X sessions. This can enable a local attacker to gain an administrator’s X session by stealing the cookie from a temporary .xauth file created after root uses su. Public sources...

CVE-2002-1227

PAM 0.76 treats a disabled password as if it were an empty null password, which allows local and remote attackers to gain privileges as disabled users...

GLSA-200404-06 : Util-linux login may leak sensitive data

The remote host is affected by the vulnerability described in GLSA-200404-06 Util-linux login may leak sensitive data In some situations the login program could leak sensitive data due to an incorrect usage of a reallocated pointer. NOTE: Only users who have PAM support disabled on their systems...

Portable OpenSSH < 3.6.1p2 PAM Timing Side-Channel Weakness

Binary data 1984.prm...

Portable OpenSSH < 3.7.1p2 Multiple PAM Vulnerabilities

Binary data 1996.prm...

Low: Red Hat Security Advisory: pam security update

Updated pam packages that fix a security vulnerability are now available for Red Hat Enterprise Linux 2.1. PAM Pluggable Authentication Modules is a system security tool that allows system administrators to set an authentication policy without having to recompile programs that handle...

RHEL 2.1 : pam (RHSA-2004:304)

Updated pam packages that fix a security vulnerability are now available for Red Hat Enterprise Linux 2.1. PAM Pluggable Authentication Modules is a system security tool that allows system administrators to set an authentication policy without having to recompile programs that handle...

Mandrake Linux Security Advisory : util-linux (MDKSA-2001:084)

Tarhon-Onu Victor found a problem in /bin/login's PAM implementation. It stored the value of a static pwent buffer across PAM calls, and when used with some PAM modules in non-default configurations ie. using pamlimits, it would overwrite the buffer and cause the user to get the credentials of...

Mandrake Linux Security Advisory : XFree86 (MDKSA-2003:118)

A vulnerability was discovered in the XDM display manager that ships with XFree86. XDM does not check for successful completion of the pamsetcred call and in the case of error conditions in the installed PAM modules, XDM may grant local root access to any user with valid login credentials. It has...

Mandrake Linux Security Advisory : kdebase (MDKSA-2003:091)

A vulnerability was discovered in all versions of KDE 2.2.0 up to and including 3.1.3. KDM does not check for successful completion of the pamsetcred call and in the case of error conditions in the installed PAM modules, KDM may grant local root access to any user with valid login credentials. It...