[security-alerts] FW: [SA23858] Linux-PAM Login Bypass Security Vulnerability

["Kazennov, Vladimir" <Vladimir.Kazennov@xxxxxxxxxx>]

> 
> ----------------------------------------------------------------------
> 
> TITLE:
> Linux-PAM Login Bypass Security Vulnerability
> 
> SECUNIA ADVISORY ID:
> SA23858
> 
> VERIFY ADVISORY:
> http://secunia.com/advisories/23858/
> 
> CRITICAL:
> Moderately critical
> 
> IMPACT:
> Security Bypass
> 
> WHERE:
> From remote
> 
> SOFTWARE:
> Linux-PAM 0.x
> http://secunia.com/product/1701/
> 
> DESCRIPTION:
> A vulnerability has been reported in Linux-PAM, which can be
> exploited by malicious people to bypass certain security
> restrictions.
> 
> The vulnerability is caused due to an error within the
> "_unix_verify_password()" function in modules/pam_unix/support.c when
> verifying a user's password. This can be exploited to login with any
> given password if the hash in the passwd file is "!!" or similar.
> 
> The vulnerability is reported in version 0.99.7.0.
> 
> SOLUTION:
> Update to version 0.99.7.1.
> 
> PROVIDED AND/OR DISCOVERED BY:
> Bernardo Innocenti
> 
> ORIGINAL ADVISORY:
> https://www.redhat.com/archives/pam-list/2007-January/msg00017.html
> http://www.redhat.com/archives/fedora-devel-list/2007-January/
> msg01277.html
>