HylaFAX Remote PAM Authentication Bypass Vulnerability

Bugtraq ID:	16150
Class:	Design Error
CVE:	CVE-2005-3538
Remote:	Yes
Local:	No
Published:	Jan 05 2006 12:00AM
Updated:	Aug 11 2006 09:10PM
Credit:	Dileep <[email protected]> reported this issue to the vendor.
Vulnerable:	Mandriva Linux Mandrake 2006.0 x86_64 Mandriva Linux Mandrake 2006.0 Mandriva Linux Mandrake 10.2 x86_64 Mandriva Linux Mandrake 10.2 Mandriva Linux Mandrake 10.1 x86_64 Mandriva Linux Mandrake 10.1 Hylafax Hylafax 4.2.3 Gentoo Linux
Not Vulnerable:	Hylafax Hylafax 4.2.4

HylaFAX Remote PAM Authentication Bypass Vulnerability

The HylaFAX daemon is reported prone to a vulnerability that could allow unauthorized access to the HylaFAX service. Reportedly, the issue presents itself due to a flaw in its PAM (Pluggable Authentication Modules) usage.

A remote attacker may exploit this vulnerability to gain unauthorized access to the affected service.

HylaFAX Remote PAM Authentication Bypass Vulnerability

An exploit is not required.

HylaFAX Remote PAM Authentication Bypass Vulnerability

Solution:
The vendor has released an advisory along with HylaFAX version 4.2.4 to address this issue.

Please see the referenced advisories for more information.


Hylafax Hylafax 4.2.3

• HylaFAX hylafax-4.2.4.tar.gz
  ftp://ftp.hylafax.org/source/hylafax-4.2.4.tar.gz

HylaFAX Remote PAM Authentication Bypass Vulnerability

References:

• Bugzilla Bug 682 - hfaxd PAM support doesn't work for non-passworded authenti (HylaFAX)
  
• Bugzilla Bug 719 - Unsanitised user-supplied data passed to eval in notify an (HylaFAX)
  
• HylaFAX 4.2.4 release (HylaFAX)
  
• Hylafax Homepage (Hylafax)
  
• Re: [hylafax-users] proceedure for hylafax setup for PAM authentiation (HylaFAX)
  
• HylaFAX Security advisory - fixed in HylaFAX 4.2.4 (Aidan Van Dyk )