CVE-2009-0887

medium
New! CVE Severity Now Using CVSS v3

The calculated severity for CVEs has been updated to use CVSS v3 by default. CVEs that do not have a CVSS v3 score will fall back CVSS v2 for calculating severity. Severity display preferences can be toggled in the settings dropdown.

Description

Integer signedness error in the _pam_StrTok function in libpam/pam_misc.c in Linux-PAM (aka pam) 1.0.3 and earlier, when a configuration file contains non-ASCII usernames, might allow remote attackers to cause a denial of service, and might allow remote authenticated users to obtain login access with a different user's non-ASCII username, via a login attempt.

References

http://openwall.com/lists/oss-security/2009/03/05/1

http://pam.cvs.sourceforge.net/viewvc/pam/Linux-PAM/libpam/pam_misc.c?r1=1.9&r2=1.10&view=patch

http://pam.cvs.sourceforge.net/viewvc/pam/Linux-PAM/libpam/pam_misc.c?view=log

http://secunia.com/advisories/34733

http://www.mandriva.com/security/advisories?name=MDVSA-2009:077

http://www.securityfocus.com/bid/34010

https://exchange.xforce.ibmcloud.com/vulnerabilities/49110

https://www.redhat.com/archives/fedora-package-announce/2009-April/msg00398.html

https://www.redhat.com/archives/fedora-package-announce/2009-April/msg00420.html

Details

Source: MITRE

Published: 2009-03-12

Updated: 2019-01-03

Type: CWE-189

Risk Information

CVSS v2

Base Score: 6.6

Vector: AV:L/AC:M/Au:S/C:C/I:C/A:C

Impact Score: 10

Exploitability Score: 2.7

Severity: MEDIUM

Tenable Plugins

View all (6 total)

IDNameProductFamilySeverity
55103Ubuntu 8.04 LTS / 10.04 LTS / 10.10 / 11.04 : pam regression (USN-1140-2)NessusUbuntu Local Security Checks
medium
55102Ubuntu 8.04 LTS / 10.04 LTS / 10.10 / 11.04 : pam vulnerabilities (USN-1140-1)NessusUbuntu Local Security Checks
medium
40879GLSA-200909-01 : Linux-PAM: Privilege escalationNessusGentoo Local Security Checks
medium
37813Fedora 10 : pam-1.0.4-4.fc10 (2009-3204)NessusFedora Local Security Checks
medium
36591Mandriva Linux Security Advisory : pam (MDVSA-2009:077)NessusMandriva Local Security Checks
medium
36156Fedora 9 : pam-1.0.4-4.fc9 (2009-3231)NessusFedora Local Security Checks
medium