glsa-200510-22.xml


1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68

<?xml version="1.0" encoding="utf-8"?>
<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
<glsa id="200510-22">
  <title>SELinux PAM: Local password guessing attack</title>
  <synopsis>
    A vulnerability in the SELinux version of PAM allows a local attacker to
    brute-force system passwords.
  </synopsis>
  <product type="ebuild">PAM</product>
  <announced>2005-10-28</announced>
  <revised count="01">2005-10-28</revised>
  <bug>109485</bug>
  <access>local</access>
  <affected>
    <package name="sys-libs/pam" auto="yes" arch="*">
      <unaffected range="ge">0.78-r3</unaffected>
      <vulnerable range="lt">0.78-r3</vulnerable>
    </package>
  </affected>
  <background>
    <p>
    PAM (Pluggable Authentication Modules) is an architecture allowing
    the separation of the development of privilege granting software from
    the development of secure and appropriate authentication schemes.
    SELinux is an operating system based on Linux which includes Mandatory
    Access Control.
    </p>
  </background>
  <description>
    <p>
    The SELinux patches for PAM introduce a vulnerability allowing a
    password to be checked with the unix_chkpwd utility without delay or
    logging. This vulnerability doesn't affect users who do not run
    SELinux.
    </p>
  </description>
  <impact type="normal">
    <p>
    A local attacker could exploit this vulnerability to brute-force
    passwords and escalate privileges on an SELinux system.
    </p>
  </impact>
  <workaround>
    <p>
    There is no known workaround at this time.
    </p>
  </workaround>
  <resolution>
    <p>
    All SELinux PAM users should upgrade to the latest version:
    </p>
    <code>
    # emerge --sync
    # emerge --ask --oneshot --verbose "&gt;=sys-libs/pam-0.78-r3"</code>
  </resolution>
  <references>
    <uri link="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2005-2977">CVE-2005-2977</uri>
  </references>
  <metadata tag="requester" timestamp="2005-10-26T15:44:45Z">
    jaervosz
  </metadata>
  <metadata tag="bugReady" timestamp="2005-10-27T07:49:03Z">
    koon
  </metadata>
  <metadata tag="submitter" timestamp="2005-10-27T12:12:27Z">
    koon
  </metadata>
</glsa>