PT-2014-3250 · Linux Pam+2 · Pam+2

Ratul Gupta · Published 2014-05-08 · Updated 2016-12-03 · CVE-2013-7041

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Medium

Base vector

AV:N/AC:M/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions Pam (affected versions not specified)

Description The issue concerns the pam userdb module for Pam, which uses a case-insensitive method to compare hashed passwords. This comparison method makes it easier for attackers to guess the password via a brute force attack.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Weakness Enumeration

CWE-310

Related Identifiers

CVE-2013-7041

MGASA-2015-0213

SUSE-SU-2016:1645-1

SUSE-SU-2016_1645-1

USN-2935-1

USN-2935-2

Affected Products

Pam

Suse

Ubuntu

References · 44

• https://nvd.nist.gov/vuln/detail/CVE-2013-7041 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-3238 · Security Note
• http://ubuntu.com/usn/USN-2935-1 · Vendor Advisory
• http://ubuntu.com/usn/USN-2935-3 · Vendor Advisory
• https://ubuntu.com/security/notices/USN-2935-1 · Vendor Advisory
• https://osv.dev/vulnerability/MGASA-2015-0213 · Vendor Advisory
• https://security.gentoo.org/glsa/201605-05 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2013-7041 · Vendor Advisory
• https://ubuntu.com/security/CVE-2014-2583 · Vendor Advisory
• https://ubuntu.com/security/notices/USN-2935-2 · Vendor Advisory
• http://ubuntu.com/usn/USN-2935-2 · Vendor Advisory
• https://osv.dev/vulnerability/USN-2935-2 · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-2583 · Security Note
• https://cve.org/CVERecord?id=CVE-2013-7041 · Security Note
• https://osv.dev/vulnerability/DEBIAN-CVE-2013-7041 · Vendor Advisory