Description
hfaxd in HylaFAX 4.2.3, when PAM support is disabled, accepts arbitrary passwords, which allows remote attackers to gain privileges.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | hylafax | 2:4.2.4-1 | — |
| Debian 13 | hylafax | 2:4.2.4-1 | — |
| Debian 12 | hylafax | 2:4.2.4-1 | — |
References
- 18314 third-party-advisory
- 18337 third-party-advisory
- http://www.hylafax.org/content/HylaFAX_4.2.4_release
- GLSA-200601-03 vendor-advisory
- [hylafax-users] 20051212 Re: proceedure for hylafax setup for PAM authentiation mailing-list
- 18489 third-party-advisory
- 20060105 HylaFAX Security advisory - fixed in HylaFAX 4.2.4 mailing-list
- http://bugs.hylafax.org/bugzilla/show_bug.cgi?id=719
- ADV-2006-0072 vdb-entry
- MDKSA-2006:015 vendor-advisory
- 16150 vdb-entry