Summary
It was discovered that the PAM pam_access module incorrectly parsed
certain rules as hostnames. An attacker could possibly use this issue to
spoof hostnames and bypass access restrictions.
Fixed packages 1
| Release | Package | Fixed in |
|---|---|---|
| Ubuntu · 24.04 LTS 24.04:LTS | pam | 1.5.3-5ubuntu5.5 |
Vulnerabilities 1
-
High 7.4
Pam: improper hostname interpretation in pam_access leads to access control bypass
A flaw was found in pam_access, where certain rules in its configuration file are mistakenly treated as hostnames. This vulnerability allows attackers to trick the system by pretending to be a trusted hostname, gaining unauthorized access. This issue poses a …
References
-
report
https://ubuntu.com/security/CVE-2024-10963