Vulnerability of the pam_sm_authenticate() function in the Yubico PAM module, pam-u2f, which allows a intruder to elevate their privileges

The vulnerability of the pamsmauthenticate function in the Yubico PAM module, specifically in pam-u2f, is related to the return of an incorrect status code. Exploiting this vulnerability could allow attackers to increase their privileges...

Privilege Escalation

libpam-sshauth is vulnerable to privilege escalation. The pamsmauthenticate function in pamsshauth.c allows a context-dependent attackers to bypass authentication or gain privileges via a system user account...

CVE-2016-4422

The pamsmauthenticate function in pamsshauth.c in libpam-sshauth might allow context-dependent attackers to bypass authentication or gain privileges via a system user account...

CVE-2016-4422

The pamsmauthenticate function in pamsshauth.c in libpam-sshauth might allow context-dependent attackers to bypass authentication or gain privileges via a system user account...

Authentication flaw

The pamsmauthenticate function in pamsshauth.c in libpam-sshauth might allow context-dependent attackers to bypass authentication or gain privileges via a system user account...

CVE-2016-4422

The pamsmauthenticate function in pamsshauth.c in libpam-sshauth might allow context-dependent attackers to bypass authentication or gain privileges via a system user account...

CVE-2016-4422

Removed by vendor...

CVE-2016-4422

Summary: CVE-2016-4422 affects libpam-sshauth (pam_sshauth.c). A weakness in pam_sm_authenticate could allow a local attacker to bypass authentication or gain root privileges by abusing system users. Affected component: libpam-sshauth, specifically the pam_sshauth PAM module. Root cause / impact ...

Design/Logic Flaw

pamsmauthenticate in pampgsql.c in libpam-pgsql 0.6.3 does not properly consider operator precedence when evaluating the success of a pamgetpass function call, which allows local users to gain privileges via a SIGINT signal when this function is executing, as demonstrated by a CTRL-C sequence at ...

CVE-2008-2516

pamsmauthenticate in pampgsql.c in libpam-pgsql 0.6.3 does not properly consider operator precedence when evaluating the success of a pamgetpass function call, which allows local users to gain privileges via a SIGINT signal when this function is executing, as demonstrated by a CTRL-C sequence at ...

CVE-2008-2516

Removed by vendor...

CVE-2008-2516

pamsmauthenticate in pampgsql.c in libpam-pgsql 0.6.3 does not properly consider operator precedence when evaluating the success of a pamgetpass function call, which allows local users to gain privileges via a SIGINT signal when this function is executing, as demonstrated by a CTRL-C sequence at ...