PT-2006-1144 · Pam-Mysql · Pam-Mysql

Moriyoshi Koizumi · Publicado 2006-02-13 · Atualizado 2011-03-08 · CVE-2006-0056

Positive Technologies (AI Summary)

CVSS v2.0

7.5

Alta

Vetor base

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions: PAM-MySQL versions 0.6.x through 0.6.1 PAM-MySQL versions 0.7.x through 0.7pre2

Description: A double free vulnerability exists in the authentication and authentication token alteration code, allowing remote attackers to cause a denial of service (application crash) and possibly execute arbitrary code via crafted passwords. This issue occurs when there are multiple PAM modules, PAM-MySQL is not evaluated first, and there are no requisite modules before PAM-MySQL.

Recommendations: For PAM-MySQL versions 0.6.x through 0.6.1, update to version 0.6.2 or later. For PAM-MySQL versions 0.7.x through 0.7pre2, update to version 0.7pre3 or later.

Correção

Buffer Overflow

Enumeração de Fraquezas

CWE-119

Identificadores relacionados

CVE-2006-0056

Produtos afetados

Pam-Mysql

Referências · 15

• https://osv.dev/vulnerability/DEBIAN-CVE-2006-0056 · Aviso do Fabricante
• http://jvn.jp/cert/JVNVU%23693909/index.html · Nota
• http://osvdb.org/22995 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2006-0056 · Nota de Segurança
• https://security-tracker.debian.org/tracker/CVE-2006-0056 · Aviso do Fabricante
• https://osv.dev/vulnerability/CVE-2006-0056 · Aviso do Fabricante
• http://kb.cert.org/vuls/id/693909 · Correção
• http://secunia.com/advisories/20690 · Aviso do Fabricante
• http://securityfocus.com/bid/16564 · Correção
• http://secunia.com/advisories/18598 · Aviso do Fabricante
• http://osvdb.org/22994 · Nota
• http://sourceforge.net/forum/forum.php?forum_id=499394 · Nota
• http://vupen.com/english/advisories/2006/0490 · Nota
• http://gentoo.org/security/en/glsa/glsa-200606-18.xml · Aviso do Fabricante
• http://securitytracker.com/id?1015603 · Correção