Detections
Analytics

GLSA-202208-11 : Yubico pam-u2f: Local PIN Bypass vulnerability

medium Nessus Plugin ID 163987

Language:

Description

The remote host is affected by the vulnerability described in GLSA-202208-11 (Yubico pam-u2f: Local PIN Bypass vulnerability)

 - Yubico pam-u2f before 1.1.1 has a logic issue that, depending on the pam-u2f configuration and the application used, could lead to a local PIN bypass. This issue does not allow user presence (touch) or cryptographic signature verification to be bypassed, so an attacker would still need to physically possess and interact with the YubiKey or another enrolled authenticator. If pam-u2f is configured to require PIN authentication, and the application using pam-u2f allows the user to submit NULL as the PIN, pam-u2f will attempt to perform a FIDO2 authentication without PIN. If this authentication is successful, the PIN requirement is bypassed. (CVE-2021-31924)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

Solution

All Yubico pam-u2f users should upgrade to the latest version:

 # emerge --sync # emerge --ask --oneshot --verbose >=sys-auth/pam_u2f-1.1.1

See Also

https://security.gentoo.org/glsa/202208-11

https://bugs.gentoo.org/show_bug.cgi?id=792270

Plugin Details

Severity: Medium

ID: 163987

File Name: gentoo_GLSA-202208-11.nasl

Version: 1.2

Type: local

Published: 8/10/2022

Updated: 8/10/2022

Supported Sensors: Nessus

Risk Information

VPR

Risk Factor: Medium

Score: 6.7

CVSS v2

Risk Factor: Medium

Base Score: 4.6

Temporal Score: 3.4

Vector: CVSS2#AV:L/AC:L/Au:N/C:P/I:P/A:P

CVSS Score Source: CVE-2021-31924

CVSS v3

Risk Factor: Medium

Base Score: 6.8

Temporal Score: 5.9

Vector: CVSS:3.0/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C

Vulnerability Information

CPE: p-cpe:/a:gentoo:linux:pam_u2f, cpe:/o:gentoo:linux

Required KB Items: Host/local_checks_enabled, Host/Gentoo/release, Host/Gentoo/qpkg-list

Exploit Ease: No known exploits are available

Patch Publication Date: 8/10/2022

Vulnerability Publication Date: 5/26/2021

Reference Information

CVE: CVE-2021-31924