Vendor
mcdope
26 known vulnerabilities.
Products
10 results · Clear filters · Feed
-
High 7.4
pam_usb: deny_remote bypassed by compressed IPv6 addresses in pusb_tmux_has_remote_clients
pam_usb provides hardware authentication for Linux using removable media. From version 0.8.0 to before version 0.9.3, the deny_remote feature in pam_usb uses /usr/bin/w -i to detect whether the authenticating user has an active remote tmux session. In pusb_tm…
-
High 7.1
pam_usb: getenv() in pusb_local_login bypasses XRDP deny via env-var unset
pam_usb provides hardware authentication for Linux using removable media. Prior to version 0.9.3, src/local.c reads XRDP_SESSION with plain getenv(3) at the head of pusb_local_login while every other env consumer in the same function uses secure_getenv(3). Wh…
-
High 7.4
pam_usb: deny_remote bypassed by zone-indexed IPv6 addresses (fe80::1%eth0) in pusb_tmux_has_remote_clients
pam_usb provides hardware authentication for Linux using removable media. From version 0.8.0 to before version 0.9.3, the deny_remote feature in pam_usb uses /usr/bin/w -i to detect whether the authenticating user has an active remote tmux session. In pusb_tm…
-
High 8.2
pam_usb: Shell injection via device UUID and username in pamusb-conf and pamusb-agent
pam_usb provides hardware authentication for Linux using ordinary removable media. Prior to 0.8.7, a crafted UUID such as $(id>/tmp/rce) in the config causes root RCE when pamusb-conf --reset-pads is run. A USB device with a crafted filesystem UUID (some cont…
-
High 7.8
pam_usb: PINENTRY_FALLBACK_APP environment variable allows arbitrary command execution
pam_usb provides hardware authentication for Linux using ordinary removable media. Prior to 0.8.7, pamusb-pinentry reads the PINENTRY_FALLBACK_APP environment variable and executes it directly without any validation. Any process that can set environment varia…
-
High 7.9
pam_usb: Symlink attacks on pad directory and pad files enable authentication bypass and root file corruption
pam_usb provides hardware authentication for Linux using ordinary removable media. Prior to 0.8.7, symlink attacks on pad directory and pad files enable authentication bypass and root file corruption. This vulnerability is fixed in 0.8.7.
-
High 8.8
pam_usb: Command injection via $TMUX environment variable leads to RCE as root
pam_usb provides hardware authentication for Linux using ordinary removable media. Prior to 0.8.7, src/tmux.c reads the user's $TMUX environment variable, splits it on commas, and interpolates the socket-path component directly into a shell command passed to …
-
High 7.4
pam_usb: deny_remote feature incorrectly classifies IPv4-mapped IPv6 remote connections as local
pam_usb provides hardware authentication for Linux using ordinary removable media. Prior to 0.9.0, pam_usb's deny_remote feature checks utmpx ut_addr_v6 to detect whether an authentication request originates from a remote session. The outer guard was if (uten…
-
High 7.1
pam_usb: OTP pad authentication bypass via missing system pad check and uninitialized RNG buffer
pam_usb provides hardware authentication for Linux using ordinary removable media. Prior to 0.9.0, the pusb_pad_compare() function in src/pad.c only verified that the user-side pad (~/.pamusb/device.pad) could be read, but did not enforce that the system-side…
-
High 8.1
pam_usb: PAM_RHOST check skipped when deny_remote=false allows XDMCP authentication bypass
pam_usb provides hardware authentication for Linux using ordinary removable media. Prior to 0.9.1, when a PAM service is configured with deny_remote=false in pam_usb (commonly done for display managers such as gdm-password or lightdm to bypass process/TTY heu…