PT-2020-13746 · Unknown+2 · Pam Tacplus+2

The-Magician · Published 2020-06-06 · Updated 2022-04-05 · CVE-2020-13881

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions pam tacplus versions 1.3.8 through 1.5.1

Description The issue concerns the logging of the TACACS+ shared secret via syslog when the DEBUG loglevel and journald are used. This occurs in the support.c file of pam tacplus.

Recommendations For pam tacplus versions 1.3.8 through 1.5.1, consider disabling the DEBUG loglevel or journald to prevent the TACACS+ shared secret from being logged via syslog until a patch is available.

Fix

Insertion into Log File

Weakness Enumeration

CWE-532

Related Identifiers

CVE-2020-13881

DLA-2239-1

DLA-2730-1

USN-4521-1

Affected Products

Linuxmint

Ubuntu

Pam Tacplus

References · 18

• https://github.com/kravietz/pam_tacplus/commit/4a9852c31c2fd0c0e72fbb689a586aabcfb11cb0 · Patch
• https://ubuntu.com/security/notices/USN-4521-1 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2020-13881 · Vendor Advisory
• https://ubuntu.com/security/CVE-2020-13881 · Vendor Advisory
• https://osv.dev/vulnerability/DLA-2239-1 · Vendor Advisory
• https://usn.ubuntu.com/4521-1 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2020-13881 · Security Note
• http://openwall.com/lists/oss-security/2020/06/08/1 · Patch
• https://osv.dev/vulnerability/DLA-2730-1 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2020-13881 · Vendor Advisory
• https://osv.dev/vulnerability/USN-4521-1 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-13881 · Security Note
• https://github.com/kravietz/pam_tacplus/issues/149 · Note
• https://lists.debian.org/debian-lts-announce/2021/08/msg00006.html · Note
• https://lists.debian.org/debian-lts-announce/2020/06/msg00007.html · Note