yubico-pam NULL Password Authentication Bypass Vulnerability

Bugtraq ID:	50557
Class:	Access Validation Error
CVE:	CVE-2011-4120
Remote:	Yes
Local:	No
Published:	Nov 07 2011 12:00AM
Updated:	Apr 13 2015 09:48PM
Credit:	Nanakos Chrysostomos
Vulnerable:	Yubico yubico-pam 2.7 Yubico yubico-pam 2.6 Yubico yubico-pam 2.5 Yubico yubico-pam 2.4
Not Vulnerable:	Yubico yubico-pam 2.8

yubico-pam NULL Password Authentication Bypass Vulnerability

yubico-pam is prone to a remote authentication-bypass vulnerability.

Remote attackers can exploit this issue to bypass the authentication mechanism and gain unauthorized access.

yubico-pam 2.4 to 2.7 are vulnerable.

yubico-pam NULL Password Authentication Bypass Vulnerability

An attacker can use readily available tools to exploit this issue.

yubico-pam NULL Password Authentication Bypass Vulnerability

Solution:
Updates are available. Please see the references for more information.

yubico-pam NULL Password Authentication Bypass Vulnerability

References:

• Yubico Homepage (Yubico)
  
• Yubico PAM 2.8 (IMPORTANT) (Yubico)
  
• yubico-pam Product Page (Yubico)