Download
| Alert*
|
oval:org.secpod.oval:def:21822
The host is installed with Linux-PAM (aka pam) 1.1.8 and is prone to multiple directory traversal vulnerabilities. The flaws are present in the application, which fails to properly handle a .. (dot dot) in the (1) PAM_RUSER value to the get_ruser function or (2) PAM_TTY value to the check_tty functi ... oval:org.secpod.oval:def:1600197 Multiple directory traversal vulnerabilities in pam_timestamp.c in the pam_timestamp module for Linux-PAM 1.1.8 allow local users to create aribitrary files or possibly bypass authentication via a .. in the PAM_RUSER value to the get_ruser function or PAM_TTY value to the check_tty funtion, whic ... oval:org.secpod.oval:def:203139 pam is installed oval:org.secpod.oval:def:108103 PAM is a system security tool that allows system administrators to set authentication policy without having to recompile programs that handle authentication. oval:org.secpod.oval:def:89044949 This update for pam fixes the following issues: - CVE-2015-3238: pam_unix in conjunction with SELinux allowed for DoS attacks . - log a hint to syslog if /etc/nologin is present, but empty . - If /etc/nologin is present, but empty, log a hint to syslog. - Added support for libowcrypt.so, if present ... oval:org.secpod.oval:def:89045339 This update for pam fixes two security issues. These security issues were fixed: - CVE-2015-3238: pam_unix in conjunction with SELinux allowed for DoS attacks . - CVE-2013-7041: Compare password hashes case-sensitively . This non-security issue was fixed: - bsc#962220: Don"t fail when /var/log/btmp ... oval:org.secpod.oval:def:203699 Pluggable Authentication Modules provide a system whereby administrators can set up authentication policies without having to recompile programs to handle authentication. It was discovered that the _unix_run_helper_binary function of PAM"s unix_pam module could write to a blocking pipe, possibly ca ... oval:org.secpod.oval:def:109251 PAM is a system security tool that allows system administrators to set authentication policy without having to recompile programs that handle authentication. oval:org.secpod.oval:def:1200164 It was discovered that the _unix_run_helper_binary function of PAM"s unix_pam module could write to a blocking pipe, possibly causing the function to become unresponsive. An attacker able to supply large passwords to the unix_pam module could use this flaw to enumerate valid user accounts, or cause ... oval:org.secpod.oval:def:203702 Pluggable Authentication Modules provide a system whereby administrators can set up authentication policies without having to recompile programs to handle authentication. It was discovered that the _unix_run_helper_binary function of PAM"s unix_pam module could write to a blocking pipe, possibly ca ... oval:org.secpod.oval:def:501633 Pluggable Authentication Modules provide a system whereby administrators can set up authentication policies without having to recompile programs to handle authentication. It was discovered that the _unix_run_helper_binary function of PAM"s unix_pam module could write to a blocking pipe, possibly ca ... oval:org.secpod.oval:def:109261 PAM is a system security tool that allows system administrators to set authentication policy without having to recompile programs that handle authentication. oval:org.secpod.oval:def:1501129 Pluggable Authentication Modules provide a system whereby administrators can set up authentication policies without having to recompile programs to handle authentication. It was discovered that the _unix_run_helper_binary function of PAM"s unix_pam module could write to a blocking pipe, possibly ca ... oval:org.secpod.oval:def:1501149 Pluggable Authentication Modules provide a system whereby administrators can set up authentication policies without having to recompile programs to handle authentication. It was discovered that the _unix_run_helper_binary function of PAM"s unix_pam module could write to a blocking pipe, possibly ca ... oval:org.secpod.oval:def:1600264 A stack-based buffer overflow flaw was found in the way the pam_env module parsed users" "~/.pam_environment" files. If an application"s PAM configuration contained "user_readenv=1" , a local attacker could use this flaw to crash the application or, possibly, escalate their privileges. A denial of s ... oval:org.secpod.oval:def:202619 Pluggable Authentication Modules provide a system whereby administrators can set up authentication policies without having to recompile programs to handle authentication. A stack-based buffer overflow flaw was found in the way the pam_env module parsed users" "~/.pam_environment" files. I ... oval:org.secpod.oval:def:1500114 Updated pam packages that fix two security issues, several bugs, and addvarious enhancements are now available for Red Hat Enterprise Linux 6.The Red Hat Security Response Team has rated this update as having moderatesecurity impact. Common Vulnerability Scoring System base scores,which give detail ... oval:org.secpod.oval:def:500311 Pluggable Authentication Modules provide a system whereby administrators can set up authentication policies without having to recompile programs that handle authentication. It was discovered that the pam_namespace module executed the external script namespace.init with an unchanged environment inhe ... oval:org.secpod.oval:def:201792 Pluggable Authentication Modules provide a system whereby administrators can set up authentication policies without having to recompile programs that handle authentication. It was discovered that the pam_namespace module executed the external script namespace.init with an unchanged environment inhe ... oval:org.secpod.oval:def:500348 Pluggable Authentication Modules provide a system whereby administrators can set up authentication policies without having to recompile programs that handle authentication. It was discovered that the pam_namespace module executed the external script namespace.init with an unchanged environment inhe ... oval:org.secpod.oval:def:1503425 Updated pam packages that fix three security issues are now available for Red Hat Enterprise Linux 6. The Red Hat Security Response Team has rated this update as having moderate security impact. Common Vulnerability Scoring System base scores, which give detailed severity ratings, are available for ... oval:org.secpod.oval:def:201858 Pluggable Authentication Modules provide a system whereby administrators can set up authentication policies without having to recompile programs that handle authentication. It was discovered that the pam_namespace module executed the external script namespace.init with an unchanged environment inhe ... oval:org.secpod.oval:def:89049726 This update for pam fixes the following issue: Security issue fixed: - CVE-2018-17953: Fixed IP address and subnet handling of pam_access.so that was not honoured correctly when a single host was specified . oval:org.secpod.oval:def:500991 Pluggable Authentication Modules provide a system whereby administrators can set up authentication policies without having to recompile programs to handle authentication. A stack-based buffer overflow flaw was found in the way the pam_env module parsed users" "~/.pam_environment" files. I ... oval:org.secpod.oval:def:89051380 This update for pam fixes the following issues: * CVE-2024-22365: Fixed a local denial of service during PAM login due to a missing check during path manipulation . oval:org.secpod.oval:def:3302195 Security update for pam oval:org.secpod.oval:def:19500592 A vulnerability was found in Linux PAM. An unprivileged user that is not yet in a corresponding mount namespace with ~/tmp mounted as a polyinstantiated dir can place a FIFO there, and a subsequent attempt to login as this user with `pam_namespace` configured will cause the `openat` in `protect_dir` ... oval:org.secpod.oval:def:89051376 This update for pam fixes the following issues: * CVE-2024-22365: Fixed a local denial of service during PAM login due to a missing check during path manipulation . * Check localtime_r return value to fix crashing oval:org.secpod.oval:def:1702122 A vulnerability was found in Linux PAM. An unprivileged user that is not yet in a corresponding mount namespace with ~/tmp mounted as a polyinstantiated dir can place a FIFO there, and a subsequent attempt to login as this user with `pam_namespace` configured will cause the `openat` in `protect_dir` ... |
