CVE-2014-3879 OpenPAM Nummularia 9.2 through 10.0 does not properly handle the error reported when an include directive refers to a policy that does not exist, which causes the loaded policy chain to no be discarde...
CriticalCVSS 9.8
EPSS 2.7%
- Published
- Updated
- Exploit status
- No public exploit known
Description
OpenPAM Nummularia 9.2 through 10.0 does not properly handle the error reported when an include directive refers to a policy that does not exist, which causes the loaded policy chain to no be discarded and allows context-dependent attackers to bypass authentication via a login (1) without a password or (2) with an incorrect password.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| freebsd | <= 9.2 | No fix listed |
References
- www.freebsd.org patch third-party-advisory
- www.openpam.org release-notes
- 67808 third-party-advisory vdb-entry
- www.securitytracker.com patch vdb-entry vendor-advisory