Description
Integer signedness error in the _pam_StrTok function in libpam/pam_misc.c in Linux-PAM (aka pam) 1.0.3 and earlier, when a configuration file contains non-ASCII usernames, might allow remote attackers to cause a denial of service, and might allow remote authenticated users to obtain login access with a different user's non-ASCII username, via a login attempt.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | pam | 1.0.1-10 | — |
| Debian 13 | pam | 1.0.1-10 | — |
| Debian 12 | pam | 1.0.1-10 | — |
References
- http://pam.cvs.sourceforge.net/viewvc/pam/Linux-PAM/libpam/pam_misc.c?r1=1.9&%3Br2=1.10&%3Bview=patch
- MDVSA-2009:077 vendor-advisory
- [oss-security] 20090305 CVE Request -- pam mailing-list
- FEDORA-2009-3204 vendor-advisory
- linuxpam-pamstrtok-priv-escalation(49110) vdb-entry
- http://pam.cvs.sourceforge.net/viewvc/pam/Linux-PAM/libpam/pam_misc.c?view=log
- 34010 vdb-entry
- FEDORA-2009-3231 vendor-advisory
- 34733 third-party-advisory