Debian DSA-177-1 : pam -- serious security violation

high Nessus Plugin ID 15014

Synopsis

The remote Debian host is missing a security-related update.

Description

A serious security violation in PAM was discovered. Disabled passwords (i.e. those with '*' in the password file) were classified as empty password and access to such accounts is granted through the regular login procedure (getty, telnet, ssh). This works for all such accounts whose shell field in the password file does not refer to /bin/false. Only version 0.76 of PAM seems to be affected by this problem.

Solution

Upgrade the pam package.

This problem has been fixed in version 0.76-6 for the current unstable distribution (sid). The stable distribution (woody), the old stable distribution (potato) and the testing distribution (sarge) are not affected by this problem.

As stated in the Debian security team FAQ, testing and unstable are rapidly moving targets and the security team does not have the resources needed to properly support those. This security advisory is an exception to that rule, due to the seriousness of the problem.

See Also

http://www.debian.org/security/2002/dsa-177

Plugin Details

Severity: High

ID: 15014

File Name: debian_DSA-177.nasl

Version: 1.13

Type: local

Agent: unix

Published: 9/29/2004

Updated: 1/4/2021

Supported Sensors: Frictionless Assessment Agent, Nessus Agent, Agentless Assessment, Nessus

Risk Information

VPR

Risk Factor: Medium

Score: 5.2

CVSS v2

Risk Factor: High

Base Score: 7.5

Temporal Score: 5.5

Vector: CVSS2#AV:N/AC:L/Au:N/C:P/I:P/A:P

Vulnerability Information

CPE: cpe:/o:debian:debian_linux

Required KB Items: Host/local_checks_enabled, Host/Debian/release, Host/Debian/dpkg-l

Exploit Ease: No known exploits are available

Vulnerability Publication Date: 4/8/2004

Reference Information

CVE: CVE-2002-1227

BID: 5994

DSA: 177