PT-2008-3973 · Unknown · Libpam-Pgsql

Julian Mehnle · Publicado 2008-06-03 · Atualizado 2017-08-08 · CVE-2008-2516

Positive Technologies (AI Summary)

CVSS v2.0

4.6

Média

Vetor base

AV:L/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions libpam-pgsql version 0.6.3

Description The issue arises from the pam sm authenticate function in pam pgsql.c, which does not correctly evaluate the success of a pam get pass function call due to operator precedence. This allows local users to gain privileges by sending a SIGINT signal while the pam get pass function is executing. An example of this is when a user presses CTRL-C at a sudo password prompt in a specific configuration.

Recommendations For libpam-pgsql version 0.6.3, consider updating to a newer version that addresses this issue, as the current version does not properly handle the SIGINT signal during the execution of the pam get pass function. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Improper Authentication

Enumeração de Fraquezas

CWE-287

Identificadores relacionados

CVE-2008-2516

Produtos afetados

Libpam-Pgsql

Referências · 8

• http://sourceforge.net/project/shownotes.php?release_id=601775 · Nota
• http://vupen.com/english/advisories/2008/1654/references · Nota
• http://secunia.com/advisories/30391 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2008-2516 · Nota de Segurança
• http://securityfocus.com/bid/29360 · Nota
• https://exchange.xforce.ibmcloud.com/vulnerabilities/42653 · Nota
• http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=481970 · Nota
• http://securitytracker.com/id?1020111 · Nota