PT-2019-6689 · Yubico · Yubico Pam Module

Jan Lieskovsky · Publicado 2019-11-26 · Atualizado 2020-08-18 · CVE-2011-4120

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Crítica

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Yubico PAM Module versions prior to 2.10

Description The issue allows a remote attacker to bypass the common authentication process by providing a NULL value as the password string, potentially gaining access to an account. This can be achieved by pressing the Ctrl-D keyboard sequence when the use first pass PAM configuration option is not used and the module is configured as 'sufficient' in the PAM configuration.

Recommendations For Yubico PAM Module versions prior to 2.10, update to version 2.10 or later to resolve the issue. As a temporary workaround, consider configuring the use first pass PAM configuration option or changing the module configuration to 'required' to minimize the risk of exploitation.

Correção

RCE

Enumeração de Fraquezas

CWE-20

Identificadores relacionados

CVE-2011-4120

Produtos afetados

Yubico Pam Module

Referências · 7

• https://nvd.nist.gov/vuln/detail/CVE-2011-4120 · Nota de Segurança
• https://security-tracker.debian.org/tracker/CVE-2011-4120 · Aviso do Fabricante
• https://access.redhat.com/security/cve/cve-2011-4120 · Nota
• https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2011-4120 · Correção
• https://openwall.com/lists/oss-security/2011/11/07/6 · Nota
• https://osv.dev/vulnerability/DEBIAN-CVE-2011-4120 · Aviso do Fabricante
• https://osv.dev/vulnerability/CVE-2011-4120 · Aviso do Fabricante