PT-2019-6689 · Yubico · Yubico Pam Module

Jan Lieskovsky · Published 2019-11-26 · Updated 2020-08-18 · CVE-2011-4120

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Yubico PAM Module versions prior to 2.10

Description The issue allows a remote attacker to bypass the common authentication process by providing a NULL value as the password string, potentially gaining access to an account. This can be achieved by pressing the Ctrl-D keyboard sequence when the use first pass PAM configuration option is not used and the module is configured as 'sufficient' in the PAM configuration.

Recommendations For Yubico PAM Module versions prior to 2.10, update to version 2.10 or later to resolve the issue. As a temporary workaround, consider configuring the use first pass PAM configuration option or changing the module configuration to 'required' to minimize the risk of exploitation.

Fix

RCE

Weakness Enumeration

CWE-20

Related Identifiers

CVE-2011-4120

Affected Products

Yubico Pam Module

References · 7

• https://nvd.nist.gov/vuln/detail/CVE-2011-4120 · Security Note
• https://security-tracker.debian.org/tracker/CVE-2011-4120 · Vendor Advisory
• https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2011-4120 · Patch
• https://osv.dev/vulnerability/DEBIAN-CVE-2011-4120 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2011-4120 · Vendor Advisory
• https://access.redhat.com/security/cve/cve-2011-4120 · Note
• https://openwall.com/lists/oss-security/2011/11/07/6 · Note