A flaw was found in Linux-Pam in versions prior to 1.5.1 in the way it handle empty passwords for non-existing users. When the user doesn't exist PAM try to authenticate with root and in the case of an empty password it successfully authenticate.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - A flaw was found in Linux-Pam in versions prior to 1.5.1 in the way it handle empty passwords for non-
    existing users. When the user doesn't exist PAM try to authenticate with root and in the case of an empty
    password it successfully authenticate. (CVE-2020-27780)

fix CVE-2020-27780: authentication bypass when the user doesn't exist

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote host is affected by the vulnerability described in GLSA-202012-06 (Linux-PAM: Authentication bypass)

    A flaw was found in Linux-Pam in the way it handle empty passwords for       non-existing users.
  Impact :

    A remote attacker, who only needs to know a non-existing username, could       bypass security restrictions and authenticate as root user.
  Workaround :

    Ensure that root account is protected by a non-empty password.

ID	Name	Product	Family	Severity
424120	Alpine: multiple linux-pam packages: security update to 1.5.1-r0	Tenable Cloud Security	Alpine Linux Local Security Checks	critical
424120	Alpine: multiple linux-pam packages: security update to 1.5.1-r0	Tenable Self-Hosted Container Security	Alpine Linux Local Security Checks	critical
405465	Alpine: linux-pam: security update to 1.5.1	Tenable Cloud Security	Alpine Linux Local Security Checks	critical
405465	Alpine: linux-pam: security update to 1.5.1	Tenable Self-Hosted Container Security	Alpine Linux Local Security Checks	critical
144091	Fedora 32 : pam (2020-bd83344365)	Nessus	Fedora Local Security Checks	critical
143493	GLSA-202012-06 : Linux-PAM: Authentication bypass	Nessus	Gentoo Local Security Checks	critical
143326	Fedora 33 : pam (2020-22532a1a81)	Nessus	Fedora Local Security Checks	critical

Detections

Analytics

CVE-2020-27780

critical

Tenable Plugins

critical

critical

critical

critical

critical

critical

critical