Description
Double free vulnerability in the authentication and authentication token alteration code in PAM-MySQL 0.6.x before 0.6.2 and 0.7.x before 0.7pre3 allows remote attackers to cause a denial of service (application crash) and possibly execute arbitrary code via crafted passwords, which lead to a double free of a pointer that was created by the pam_get_item function. NOTE: this issue only occurs in certain configurations in which there are multiple PAM modules, PAM-MySQL is not evaluated first, and there are no requisite modules before PAM-MySQL.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | pam-mysql | 0.6.2-1 | — |
| Debian 13 | pam-mysql | 0.6.2-1 | — |
| Debian 12 | pam-mysql | 0.6.2-1 | — |
References
- 16564 vdb-entry
- VU#693909 third-party-advisory
- 22994 vdb-entry
- http://jvn.jp/cert/JVNVU%23693909/index.html
- 1015603 vdb-entry
- ADV-2006-0490 vdb-entry
- 22995 vdb-entry
- 18598 third-party-advisory
- http://sourceforge.net/forum/forum.php?forum_id=499394
- GLSA-200606-18 vendor-advisory
- 20690 third-party-advisory