CVE-2011-4120 Yubico PAM Module before 2.10 performed user authentication when 'use_first_pass' PAM configuration option was not used and the module was configured as 'sufficient' in the PAM configuration. A remote...
CriticalCVSS 9.8
EPSS 2.0%
- Published
- Updated
- Exploit status
- No public exploit known
Description
Yubico PAM Module before 2.10 performed user authentication when 'use_first_pass' PAM configuration option was not used and the module was configured as 'sufficient' in the PAM configuration. A remote attacker could use this flaw to circumvent common authentication process and obtain access to the account in question by providing a NULL value (pressing Ctrl-D keyboard sequence) as the password string.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| debian/yubico-pam(Debian:12) | < 2.10-1 | 2.10-1 |
| debian/yubico-pam(Debian:13) | < 2.10-1 | 2.10-1 |
| debian/yubico-pam(Debian:14) | < 2.10-1 | 2.10-1 |
| Yubico pam module | < 2.10 | 2.10 |
| debian linux | = 8.0 | No fix listed |
| debian linux | = 9.0 | No fix listed |
| debian linux | = 10.0 | No fix listed |
| yubico-pam | = before 2.10 | No fix listed |
References
- Debian Security Tracker CVE-2011-4120 third-party-advisory vendor-advisory
- access.redhat.com broken-link third-party-advisory
- bugzilla.redhat.com issue-tracking patch third-party-advisory
- www.openwall.com mailing-list third-party-advisory