更新修正輕微的安全性問題 CVE-2015-3238。

請注意，Tenable Network Security 已直接從 Fedora 安全性公告擷取前置描述區塊。Tenable 已盡量在不造成其他問題的前提下，嘗試自動清理並將其格式化。

在 1.2.1 版之前的 Linux-PAM (即 pam) 中，pam_unix 模組的 _unix_run_helper_binary 函式在無法直接存取密碼時，會允許本機使用者透過大型密碼列舉使用者名稱或造成拒絕服務 (懸置)。

據發現，PAM pam_userdb 模組比較雜湊密碼時，並未正確使用區分大小寫方法。本機攻擊者可能利用此問題，更輕易地發動暴力密碼破解攻擊。此問題僅影響 Ubuntu 12.04 LTS 和 Ubuntu 14.04 LTS。(CVE-2013-7041)

Sebastian Krahmer 發現 PAM pam_timestamp 模組未正確執行篩選。本機攻擊者可利用此問題建立任意檔案，或可能繞過驗證。此問題僅影響 Ubuntu 12.04 LTS 和 Ubuntu 14.04 LTS。
(CVE-2014-2583)

Sebastien Macke 發現 PAM pam_unix 模組未正確處理大型密碼。本機攻擊者可能在特定環境中利用此問題列舉使用者名稱，或是造成拒絕服務。(CVE-2015-3238)

請注意，Tenable Network Security 已直接從 Ubuntu 安全性公告擷取前述描述區塊。Tenable 已盡量在不造成其他問題的前提下，嘗試自動清理並將其格式化。

According to the version of the pam package installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerability :

  - It was discovered that the _unix_run_helper_binary()     function of PAM's unix_pam module could write to a     blocking pipe, possibly causing the function to become     unresponsive. An attacker able to supply large     passwords to the unix_pam module could use this flaw to     enumerate valid user accounts, or cause a denial of     service on the system.(CVE-2015-3238)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote Oracle Linux 6 / 7 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2015-1640 advisory.

    [1.1.1-20.1]
    - fix CVE-2015-3238 - DoS due to blocking pipe with very long password

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

An updated pam package that fixes one security issue is now available for Red Hat Enterprise Linux 6 and 7.

Red Hat Product Security has rated this update as having Moderate security impact. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available from the CVE link in the References section.

Pluggable Authentication Modules (PAM) provide a system whereby administrators can set up authentication policies without having to recompile programs to handle authentication.

It was discovered that the _unix_run_helper_binary() function of PAM's unix_pam module could write to a blocking pipe, possibly causing the function to become unresponsive. An attacker able to supply large passwords to the unix_pam module could use this flaw to enumerate valid user accounts, or cause a denial of service on the system.
(CVE-2015-3238)

Red Hat would like to thank Sebastien Macke of Trustwave SpiderLabs for reporting this issue.

All pam users are advised to upgrade to this updated package, which contains a backported patch to correct this issue.

This update for pam fixes two security issues.

These security issues were fixed :

  - CVE-2015-3238: pam_unix in conjunction with SELinux     allowed for DoS attacks (bsc#934920).

  - CVE-2013-7041: Compare password hashes case-sensitively     (bsc#854480).

The update package also includes non-security fixes. See advisory for details.

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

USN-2935-1 fixed vulnerabilities in PAM. The updates contained a packaging change that prevented upgrades in certain multiarch environments. USN-2935-2 intended to fix the problem but was incomplete for Ubuntu 12.04 LTS. This update fixes the problem in Ubuntu 12.04 LTS.

We apologize for the inconvenience.

It was discovered that the PAM pam_userdb module incorrectly used a case-insensitive method when comparing hashed passwords. A local attacker could possibly use this issue to make brute-force attacks easier. This issue only affected Ubuntu 12.04 LTS and Ubuntu 14.04 LTS. (CVE-2013-7041)

Sebastian Krahmer discovered that the PAM pam_timestamp module incorrectly performed filtering. A local attacker could use this issue to create arbitrary files, or possibly bypass authentication. This issue only affected Ubuntu 12.04 LTS and Ubuntu 14.04 LTS. (CVE-2014-2583)

Sebastien Macke discovered that the PAM pam_unix module incorrectly handled large passwords. A local attacker could possibly use this issue in certain environments to enumerate usernames or cause a denial of service. (CVE-2015-3238).

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote host is affected by the vulnerability described in GLSA-201605-05 (Linux-PAM: Multiple vulnerabilities)

    Multiple vulnerabilities have been discovered in Linux-PAM.  Please       review the CVE identifiers referenced below for details.
  Impact :

    Remote attackers could cause Denial of Service, conduct brute-force attacks, and conduct username enumeration.
  Workaround :

    There is no known workaround at this time.

ID	Name	Product	Family	Published	Updated	Severity
84520	Fedora 21 : pam-1.1.8-19.fc21 (2015-10848)	Nessus	Fedora Local Security Checks	7/6/2015	1/11/2021	medium
88438	F5 Networks BIG-IP：PAM 弱點 (SOL17494)	Nessus	F5 Networks Local Security Checks	1/28/2016	3/10/2021	medium
89996	Ubuntu 14.04 LTS：PAM 弱點 (USN-2935-1)	Nessus	Ubuntu Local Security Checks	3/17/2016	9/3/2025	medium
119066	EulerOS Virtualization 2.5.1 : pam (EulerOS-SA-2018-1375)	Nessus	Huawei Local Security Checks	11/21/2018	7/22/2024	medium
85526	Oracle Linux 6 / 7 : pam (ELSA-2015-1640)	Nessus	Oracle Linux Local Security Checks	8/19/2015	10/22/2024	medium
85530	RHEL 6 / 7 : pam (RHSA-2015:1640)	Nessus	Red Hat Local Security Checks	8/19/2015	10/24/2019	medium
93163	SUSE SLES11 Security Update : pam (SUSE-SU-2016:1645-1)	Nessus	SuSE Local Security Checks	8/29/2016	1/19/2021	medium
90021	Ubuntu 12.04 LTS : pam regression (USN-2935-3)	Nessus	Ubuntu Local Security Checks	3/18/2016	1/12/2023	medium
91378	GLSA-201605-05 : Linux-PAM: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	5/31/2016	1/11/2021	medium

Detections

Analytics

Plugins Search

medium

medium

medium

medium

medium

medium

medium

medium

medium