Ubuntu PAM Authentication Security Bypass Vulnerability

Bugtraq ID:	36306
Class:	Access Validation Error
CVE:
Remote:	Yes
Local:	No
Published:	Sep 08 2009 12:00AM
Updated:	Sep 10 2009 06:01PM
Credit:	Russell Senior
Vulnerable:	Ubuntu Ubuntu Linux 9.04 sparc Ubuntu Ubuntu Linux 9.04 powerpc Ubuntu Ubuntu Linux 9.04 lpia Ubuntu Ubuntu Linux 9.04 i386 Ubuntu Ubuntu Linux 9.04 amd64 Ubuntu Ubuntu Linux 8.10 sparc Ubuntu Ubuntu Linux 8.10 powerpc Ubuntu Ubuntu Linux 8.10 lpia Ubuntu Ubuntu Linux 8.10 i386 Ubuntu Ubuntu Linux 8.10 amd64
Not Vulnerable:

Ubuntu PAM Authentication Security Bypass Vulnerability

Ubuntu PAM is prone to a security-bypass vulnerability because the software fails to properly check access permissions.

Attackers can exploit this issue to authenticate as a user with arbitrary privileges.

Ubuntu PAM Authentication Security Bypass Vulnerability

Attackers can use standard tools to exploit this issue.

Ubuntu PAM Authentication Security Bypass Vulnerability

Solution:
Updates are available. Please see the references for details.


Ubuntu Ubuntu Linux 8.10 lpia

• Ubuntu libpam-cracklib_1.0.1-4ubuntu5.6_lpia.deb
  http://ports.ubuntu.com/pool/main/p/pam/libpam-cracklib_1.0.1-4ubuntu5 .6_lpia.deb


• Ubuntu libpam-doc_1.0.1-4ubuntu5.6_all.deb
  http://security.ubuntu.com/ubuntu/pool/main/p/pam/libpam-doc_1.0.1-4ub untu5.6_all.deb


• Ubuntu libpam-modules_1.0.1-4ubuntu5.6_lpia.deb
  http://ports.ubuntu.com/pool/main/p/pam/libpam-modules_1.0.1-4ubuntu5. 6_lpia.deb


• Ubuntu libpam-runtime_1.0.1-4ubuntu5.6_all.deb
  http://security.ubuntu.com/ubuntu/pool/main/p/pam/libpam-runtime_1.0.1 -4ubuntu5.6_all.deb


• Ubuntu libpam0g-dev_1.0.1-4ubuntu5.6_lpia.deb
  http://ports.ubuntu.com/pool/main/p/pam/libpam0g-dev_1.0.1-4ubuntu5.6_ lpia.deb


• Ubuntu libpam0g_1.0.1-4ubuntu5.6_lpia.deb
  http://ports.ubuntu.com/pool/main/p/pam/libpam0g_1.0.1-4ubuntu5.6_lpia .deb

Ubuntu Ubuntu Linux 9.04 i386

• Ubuntu libpam-cracklib_1.0.1-9ubuntu1.1_i386.deb
  http://security.ubuntu.com/ubuntu/pool/main/p/pam/libpam-cracklib_1.0. 1-9ubuntu1.1_i386.deb


• Ubuntu libpam-doc_1.0.1-9ubuntu1.1_all.deb
  http://security.ubuntu.com/ubuntu/pool/main/p/pam/libpam-doc_1.0.1-9ub untu1.1_all.deb


• Ubuntu libpam-modules_1.0.1-9ubuntu1.1_i386.deb
  http://security.ubuntu.com/ubuntu/pool/main/p/pam/libpam-modules_1.0.1 -9ubuntu1.1_i386.deb


• Ubuntu libpam-runtime_1.0.1-9ubuntu1.1_all.deb
  http://security.ubuntu.com/ubuntu/pool/main/p/pam/libpam-runtime_1.0.1 -9ubuntu1.1_all.deb


• Ubuntu libpam0g-dev_1.0.1-9ubuntu1.1_i386.deb
  http://security.ubuntu.com/ubuntu/pool/main/p/pam/libpam0g-dev_1.0.1-9 ubuntu1.1_i386.deb


• Ubuntu libpam0g_1.0.1-9ubuntu1.1_i386.deb
  http://security.ubuntu.com/ubuntu/pool/main/p/pam/libpam0g_1.0.1-9ubun tu1.1_i386.deb

Ubuntu Ubuntu Linux 9.04 amd64

• Ubuntu libpam-cracklib_1.0.1-9ubuntu1.1_amd64.deb
  http://security.ubuntu.com/ubuntu/pool/main/p/pam/libpam-cracklib_1.0. 1-9ubuntu1.1_amd64.deb


• Ubuntu libpam-doc_1.0.1-9ubuntu1.1_all.deb
  http://security.ubuntu.com/ubuntu/pool/main/p/pam/libpam-doc_1.0.1-9ub untu1.1_all.deb


• Ubuntu libpam-modules_1.0.1-9ubuntu1.1_amd64.deb
  http://security.ubuntu.com/ubuntu/pool/main/p/pam/libpam-modules_1.0.1 -9ubuntu1.1_amd64.deb


• Ubuntu libpam-runtime_1.0.1-9ubuntu1.1_all.deb
  http://security.ubuntu.com/ubuntu/pool/main/p/pam/libpam-runtime_1.0.1 -9ubuntu1.1_all.deb


• Ubuntu libpam0g-dev_1.0.1-9ubuntu1.1_amd64.deb
  http://security.ubuntu.com/ubuntu/pool/main/p/pam/libpam0g-dev_1.0.1-9 ubuntu1.1_amd64.deb


• Ubuntu libpam0g_1.0.1-9ubuntu1.1_amd64.deb
  http://security.ubuntu.com/ubuntu/pool/main/p/pam/libpam0g_1.0.1-9ubun tu1.1_amd64.deb

Ubuntu Ubuntu Linux 9.04 lpia

• Ubuntu libpam-cracklib_1.0.1-9ubuntu1.1_lpia.deb
  http://ports.ubuntu.com/pool/main/p/pam/libpam-cracklib_1.0.1-9ubuntu1 .1_lpia.deb


• Ubuntu libpam-doc_1.0.1-9ubuntu1.1_all.deb
  http://security.ubuntu.com/ubuntu/pool/main/p/pam/libpam-doc_1.0.1-9ub untu1.1_all.deb


• Ubuntu libpam-modules_1.0.1-9ubuntu1.1_lpia.deb
  http://ports.ubuntu.com/pool/main/p/pam/libpam-modules_1.0.1-9ubuntu1. 1_lpia.deb


• Ubuntu libpam-runtime_1.0.1-9ubuntu1.1_all.deb
  http://security.ubuntu.com/ubuntu/pool/main/p/pam/libpam-runtime_1.0.1 -9ubuntu1.1_all.deb


• Ubuntu libpam0g-dev_1.0.1-9ubuntu1.1_lpia.deb
  http://ports.ubuntu.com/pool/main/p/pam/libpam0g-dev_1.0.1-9ubuntu1.1_ lpia.deb


• Ubuntu libpam0g_1.0.1-9ubuntu1.1_lpia.deb
  http://ports.ubuntu.com/pool/main/p/pam/libpam0g_1.0.1-9ubuntu1.1_lpia .deb

Ubuntu Ubuntu Linux 8.10 sparc

• Ubuntu libpam-cracklib_1.0.1-4ubuntu5.6_sparc.deb
  http://ports.ubuntu.com/pool/main/p/pam/libpam-cracklib_1.0.1-4ubuntu5 .6_sparc.deb


• Ubuntu libpam-doc_1.0.1-4ubuntu5.6_all.deb
  http://security.ubuntu.com/ubuntu/pool/main/p/pam/libpam-doc_1.0.1-4ub untu5.6_all.deb


• Ubuntu libpam-modules_1.0.1-4ubuntu5.6_sparc.deb
  http://ports.ubuntu.com/pool/main/p/pam/libpam-modules_1.0.1-4ubuntu5. 6_sparc.deb


• Ubuntu libpam-runtime_1.0.1-4ubuntu5.6_all.deb
  http://security.ubuntu.com/ubuntu/pool/main/p/pam/libpam-runtime_1.0.1 -4ubuntu5.6_all.deb


• Ubuntu libpam0g-dev_1.0.1-4ubuntu5.6_sparc.deb
  http://ports.ubuntu.com/pool/main/p/pam/libpam0g-dev_1.0.1-4ubuntu5.6_ sparc.deb


• Ubuntu libpam0g_1.0.1-4ubuntu5.6_sparc.deb
  http://ports.ubuntu.com/pool/main/p/pam/libpam0g_1.0.1-4ubuntu5.6_spar c.deb

Ubuntu Ubuntu Linux 9.04 sparc

• Ubuntu libpam-cracklib_1.0.1-9ubuntu1.1_sparc.deb
  http://ports.ubuntu.com/pool/main/p/pam/libpam-cracklib_1.0.1-9ubuntu1 .1_sparc.deb


• Ubuntu libpam-doc_1.0.1-9ubuntu1.1_all.deb
  http://security.ubuntu.com/ubuntu/pool/main/p/pam/libpam-doc_1.0.1-9ub untu1.1_all.deb


• Ubuntu libpam-modules_1.0.1-9ubuntu1.1_sparc.deb
  http://ports.ubuntu.com/pool/main/p/pam/libpam-modules_1.0.1-9ubuntu1. 1_sparc.deb


• Ubuntu libpam-runtime_1.0.1-9ubuntu1.1_all.deb
  http://security.ubuntu.com/ubuntu/pool/main/p/pam/libpam-runtime_1.0.1 -9ubuntu1.1_all.deb


• Ubuntu libpam0g-dev_1.0.1-9ubuntu1.1_sparc.deb
  http://ports.ubuntu.com/pool/main/p/pam/libpam0g-dev_1.0.1-9ubuntu1.1_ sparc.deb


• Ubuntu libpam0g_1.0.1-9ubuntu1.1_sparc.deb
  http://ports.ubuntu.com/pool/main/p/pam/libpam0g_1.0.1-9ubuntu1.1_spar c.deb

Ubuntu Ubuntu Linux 8.10 powerpc

• Ubuntu libpam-cracklib_1.0.1-4ubuntu5.6_powerpc.deb
  http://ports.ubuntu.com/pool/main/p/pam/libpam-cracklib_1.0.1-4ubuntu5 .6_powerpc.deb


• Ubuntu libpam-doc_1.0.1-4ubuntu5.6_all.deb
  http://security.ubuntu.com/ubuntu/pool/main/p/pam/libpam-doc_1.0.1-4ub untu5.6_all.deb


• Ubuntu libpam-modules_1.0.1-4ubuntu5.6_powerpc.deb
  http://ports.ubuntu.com/pool/main/p/pam/libpam-modules_1.0.1-4ubuntu5. 6_powerpc.deb


• Ubuntu libpam-runtime_1.0.1-4ubuntu5.6_all.deb
  http://security.ubuntu.com/ubuntu/pool/main/p/pam/libpam-runtime_1.0.1 -4ubuntu5.6_all.deb


• Ubuntu libpam0g-dev_1.0.1-4ubuntu5.6_powerpc.deb
  http://ports.ubuntu.com/pool/main/p/pam/libpam0g-dev_1.0.1-4ubuntu5.6_ powerpc.deb


• Ubuntu libpam0g_1.0.1-4ubuntu5.6_powerpc.deb
  http://ports.ubuntu.com/pool/main/p/pam/libpam0g_1.0.1-4ubuntu5.6_powe rpc.deb

Ubuntu Ubuntu Linux 8.10 amd64

• Ubuntu libpam-cracklib_1.0.1-4ubuntu5.6_amd64.deb
  http://security.ubuntu.com/ubuntu/pool/main/p/pam/libpam-cracklib_1.0. 1-4ubuntu5.6_amd64.deb


• Ubuntu libpam-doc_1.0.1-4ubuntu5.6_all.deb
  http://security.ubuntu.com/ubuntu/pool/main/p/pam/libpam-doc_1.0.1-4ub untu5.6_all.deb


• Ubuntu libpam-modules_1.0.1-4ubuntu5.6_amd64.deb
  http://security.ubuntu.com/ubuntu/pool/main/p/pam/libpam-modules_1.0.1 -4ubuntu5.6_amd64.deb


• Ubuntu libpam-runtime_1.0.1-4ubuntu5.6_all.deb
  http://security.ubuntu.com/ubuntu/pool/main/p/pam/libpam-runtime_1.0.1 -4ubuntu5.6_all.deb


• Ubuntu libpam0g-dev_1.0.1-4ubuntu5.6_amd64.deb
  http://security.ubuntu.com/ubuntu/pool/main/p/pam/libpam0g-dev_1.0.1-4 ubuntu5.6_amd64.deb


• Ubuntu libpam0g_1.0.1-4ubuntu5.6_amd64.deb
  http://security.ubuntu.com/ubuntu/pool/main/p/pam/libpam0g_1.0.1-4ubun tu5.6_amd64.deb

Ubuntu Ubuntu Linux 8.10 i386

• Ubuntu libpam-cracklib_1.0.1-4ubuntu5.6_i386.deb
  http://security.ubuntu.com/ubuntu/pool/main/p/pam/libpam-cracklib_1.0. 1-4ubuntu5.6_i386.deb


• Ubuntu libpam-doc_1.0.1-4ubuntu5.6_all.deb
  http://security.ubuntu.com/ubuntu/pool/main/p/pam/libpam-doc_1.0.1-4ub untu5.6_all.deb


• Ubuntu libpam-modules_1.0.1-4ubuntu5.6_i386.deb
  http://security.ubuntu.com/ubuntu/pool/main/p/pam/libpam-modules_1.0.1 -4ubuntu5.6_i386.deb


• Ubuntu libpam-runtime_1.0.1-4ubuntu5.6_all.deb
  http://security.ubuntu.com/ubuntu/pool/main/p/pam/libpam-runtime_1.0.1 -4ubuntu5.6_all.deb


• Ubuntu libpam0g-dev_1.0.1-4ubuntu5.6_i386.deb
  http://security.ubuntu.com/ubuntu/pool/main/p/pam/libpam0g-dev_1.0.1-4 ubuntu5.6_i386.deb


• Ubuntu libpam0g_1.0.1-4ubuntu5.6_i386.deb
  http://security.ubuntu.com/ubuntu/pool/main/p/pam/libpam0g_1.0.1-4ubun tu5.6_i386.deb

Ubuntu Ubuntu Linux 9.04 powerpc

• Ubuntu libpam-cracklib_1.0.1-9ubuntu1.1_powerpc.deb
  http://ports.ubuntu.com/pool/main/p/pam/libpam-cracklib_1.0.1-9ubuntu1 .1_powerpc.deb


• Ubuntu libpam-doc_1.0.1-9ubuntu1.1_all.deb
  http://security.ubuntu.com/ubuntu/pool/main/p/pam/libpam-doc_1.0.1-9ub untu1.1_all.deb


• Ubuntu libpam-modules_1.0.1-9ubuntu1.1_powerpc.deb
  http://ports.ubuntu.com/pool/main/p/pam/libpam-modules_1.0.1-9ubuntu1. 1_powerpc.deb


• Ubuntu libpam-runtime_1.0.1-9ubuntu1.1_all.deb
  http://security.ubuntu.com/ubuntu/pool/main/p/pam/libpam-runtime_1.0.1 -9ubuntu1.1_all.deb


• Ubuntu libpam0g-dev_1.0.1-9ubuntu1.1_powerpc.deb
  http://ports.ubuntu.com/pool/main/p/pam/libpam0g-dev_1.0.1-9ubuntu1.1_ powerpc.deb


• Ubuntu libpam0g_1.0.1-9ubuntu1.1_powerpc.deb
  http://ports.ubuntu.com/pool/main/p/pam/libpam0g_1.0.1-9ubuntu1.1_powe rpc.deb

Ubuntu PAM Authentication Security Bypass Vulnerability

References:

• Ubuntu Homepage (Ubuntu)