PT-2014-3250 · Linux Pam+2 · Pam+2

Ratul Gupta · Publicado 2014-05-08 · Atualizado 2016-12-03 · CVE-2013-7041

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Média

Vetor base

AV:N/AC:M/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions Pam (affected versions not specified)

Description The issue concerns the pam userdb module for Pam, which uses a case-insensitive method to compare hashed passwords. This comparison method makes it easier for attackers to guess the password via a brute force attack.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Enumeração de Fraquezas

CWE-310

Identificadores relacionados

CVE-2013-7041

MGASA-2015-0213

SUSE-SU-2016:1645-1

SUSE-SU-2016_1645-1

USN-2935-1

USN-2935-2

Produtos afetados

Pam

Suse

Ubuntu

Referências · 44

• https://git.fedorahosted.org/cgit/linux-pam.git/commit/?id=Linux-PAM-1_1_8-32-g9dcead8 · Nota
• https://trustwave.com/Resources/SpiderLabs-Blog/Username-Enumeration-against-OpenSSH-SELinux-with-CVE-2015-3238 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2013-7041 · Nota de Segurança
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-3238 · Nota de Segurança
• http://ubuntu.com/usn/USN-2935-1 · Aviso do Fabricante
• http://openwall.com/lists/oss-security/2013/12/09/16 · Nota
• http://ubuntu.com/usn/USN-2935-3 · Aviso do Fabricante
• http://lists.suse.com/mailman/listinfo/sle-security-updates · Nota
• https://ubuntu.com/security/notices/USN-2935-1 · Aviso do Fabricante
• https://osv.dev/vulnerability/MGASA-2015-0213 · Aviso do Fabricante
• https://security.gentoo.org/glsa/201605-05 · Aviso do Fabricante
• https://bugs.mageia.org/show_bug.cgi?id=11937 · Nota
• https://osv.dev/vulnerability/UBUNTU-CVE-2013-7041 · Aviso do Fabricante
• https://ubuntu.com/security/CVE-2014-2583 · Aviso do Fabricante
• https://ubuntu.com/security/notices/USN-2935-2 · Aviso do Fabricante