PT-2006-1144 · Pam-Mysql · Pam-Mysql

Moriyoshi Koizumi · Published 2006-02-13 · Updated 2011-03-08 · CVE-2006-0056

Positive Technologies (AI Summary)

CVSS v2.0

7.5

High

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions: PAM-MySQL versions 0.6.x through 0.6.1 PAM-MySQL versions 0.7.x through 0.7pre2

Description: A double free vulnerability exists in the authentication and authentication token alteration code, allowing remote attackers to cause a denial of service (application crash) and possibly execute arbitrary code via crafted passwords. This issue occurs when there are multiple PAM modules, PAM-MySQL is not evaluated first, and there are no requisite modules before PAM-MySQL.

Recommendations: For PAM-MySQL versions 0.6.x through 0.6.1, update to version 0.6.2 or later. For PAM-MySQL versions 0.7.x through 0.7pre2, update to version 0.7pre3 or later.

Fix

Buffer Overflow

Weakness Enumeration

CWE-119

Related Identifiers

CVE-2006-0056

Affected Products

Pam-Mysql

References · 15

• https://osv.dev/vulnerability/DEBIAN-CVE-2006-0056 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2006-0056 · Security Note
• https://security-tracker.debian.org/tracker/CVE-2006-0056 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2006-0056 · Vendor Advisory
• http://kb.cert.org/vuls/id/693909 · Patch
• http://secunia.com/advisories/20690 · Vendor Advisory
• http://securityfocus.com/bid/16564 · Patch
• http://secunia.com/advisories/18598 · Vendor Advisory
• http://gentoo.org/security/en/glsa/glsa-200606-18.xml · Vendor Advisory
• http://securitytracker.com/id?1015603 · Patch
• http://jvn.jp/cert/JVNVU%23693909/index.html · Note
• http://osvdb.org/22995 · Note
• http://osvdb.org/22994 · Note
• http://sourceforge.net/forum/forum.php?forum_id=499394 · Note
• http://vupen.com/english/advisories/2006/0490 · Note