Veracode Vulnerability DatabaseVERACODE:11766Denial Of Service (DoS)
6.5 Medium
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
LOW
Integrity Impact
NONE
Availability Impact
LOW
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L
5.8 Medium
CVSS2
Access Vector
NETWORK
Access Complexity
MEDIUM
Authentication
NONE
Confidentiality Impact
PARTIAL
Integrity Impact
NONE
Availability Impact
PARTIAL
AV:N/AC:M/Au:N/C:P/I:N/A:P
pam is vulnerable to denial of service (DoS) attacks. The vulnerability exists as the _unix_run_helper_binary function in the pam_unix module in Linux-PAM (aka pam) before 1.2.1, when unable to directly access passwords, allows local users to enumerate usernames or cause a denial of service (hang) via a large password.
| CPE | Name | Operator | Version |
|---|---|---|---|
| pam | eq | 1.1.1__4.el6 | |
| pam | eq | 1.1.1__17.el6 | |
| pam | eq | 1.1.1__10.el6_2.1 | |
| pam | eq | 1.1.1__4.el6_0.1 | |
| pam | eq | 1.1.1__8.el6 | |
| pam | eq | 1.1.1__13.el6 | |
| pam | eq | 1.1.1__10.el6 | |
| pam | eq | 1.1.1__4.el6 | |
| pam | eq | 1.1.1__17.el6 | |
| pam | eq | 1.1.1__10.el6_2.1 |
References
lists.fedoraproject.org/pipermail/package-announce/2015-July/161350.html
lists.fedoraproject.org/pipermail/package-announce/2015-June/161249.html
rhn.redhat.com/errata/RHSA-2015-1640.html
www.openwall.com/lists/oss-security/2015/06/25/13
www.oracle.com/technetwork/security-advisory/cpuapr2016v3-2985753.html
www.securityfocus.com/bid/75428
www.ubuntu.com/usn/USN-2935-1
www.ubuntu.com/usn/USN-2935-2
www.ubuntu.com/usn/USN-2935-3
access.redhat.com/errata/RHSA-2015:1640
access.redhat.com/security/cve/CVE-2015-3238
access.redhat.com/security/updates/classification/#moderate
bugzilla.redhat.com/show_bug.cgi?id=1228571
rhn.redhat.com/errata/RHSA-2015-1640.html
security.gentoo.org/glsa/201605-05
www.trustwave.com/Resources/Security-Advisories/Advisories/TWSL2015-011/?fid=6551
www.trustwave.com/Resources/SpiderLabs-Blog/Username-Enumeration-against-OpenSSH-SELinux-with-CVE-2015-3238/
Related
6.5 Medium
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
LOW
Integrity Impact
NONE
Availability Impact
LOW
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L
5.8 Medium
CVSS2
Access Vector
NETWORK
Access Complexity
MEDIUM
Authentication
NONE
Confidentiality Impact
PARTIAL
Integrity Impact
NONE
Availability Impact
PARTIAL
AV:N/AC:M/Au:N/C:P/I:N/A:P