Vulmon Recent Vulnerabilities Research Posts Trends Blog About Contact
6.6
CVSSv2

CVE-2009-0887

Published: 12/03/2009 Updated: 07/11/2023
CVSS v2 Base Score: 6.6 | Impact Score: 10 | Exploitability Score: 2.7
VMScore: 587
Vector: AV:L/AC:M/Au:S/C:C/I:C/A:C
Subscribe to Linux-pam

Vulnerability Summary

Integer signedness error in the _pam_StrTok function in libpam/pam_misc.c in Linux-PAM (aka pam) 1.0.3 and previous versions, when a configuration file contains non-ASCII usernames, might allow remote malicious users to cause a denial of service, and might allow remote authenticated users to obtain login access with a different user's non-ASCII username, via a login attempt.

Vulnerable Product Search on Vulmon Subscribe to Product

linux-pam linux-pam 0.99.1.0

linux-pam linux-pam 0.99.2.0

linux-pam linux-pam 0.99.2.1

linux-pam linux-pam 0.99.3.0

linux-pam linux-pam 0.99.4.0

linux-pam linux-pam 0.99.5.0

linux-pam linux-pam 0.99.6.0

linux-pam linux-pam 0.99.6.1

linux-pam linux-pam 0.99.6.2

linux-pam linux-pam 0.99.6.3

linux-pam linux-pam 0.99.7.0

linux-pam linux-pam 0.99.7.1

linux-pam linux-pam 0.99.8.0

linux-pam linux-pam 0.99.8.1

linux-pam linux-pam 0.99.9.0

linux-pam linux-pam 0.99.10.0

linux-pam linux-pam 1.0.0

linux-pam linux-pam 1.0.1

linux-pam linux-pam 1.0.2

linux-pam linux-pam

Vendor Advisories

Ubuntu Security Notice: pam vulnerabilities
An attacker could cause PAM to read or delete arbitrary files or cause it to crash ...
Ubuntu Security Notice: pam regression
The USN-1140-1 PAM update caused cron to stop working ...
Debian CVElist Bug Report Logs: chage -m / passwd -n (--mindays) have no effect (Lenny)
Debian Bug report logs - #514437 chage -m / passwd -n (--mindays) have no effect (Lenny) Package: libpam-modules; Maintainer for libpam-modules is Steve Langasek <vorlon@debianorg>; Source for libpam-modules is src:pam (PTS, buildd, popcon) Reported by: Stefan Lienesch <lieneschgag@ewetelnet> Date: Sat, 7 Feb 200 ...
Debian CVElist Bug Report Logs: pam-auth-update does not prohibit selecting an empty set of modules
Debian Bug report logs - #519927 pam-auth-update does not prohibit selecting an empty set of modules Package: pam; Maintainer for pam is Steve Langasek <vorlon@debianorg>; Reported by: Russell Senior <seniorr@aracnetcom> Date: Mon, 16 Mar 2009 10:48:34 UTC Severity: serious Tags: security Merged with 521038, 528794 ...
Debian CVElist Bug Report Logs: pam: CVE-2009-0887 integer signedness error could lead to DoS or authentication bypass
Debian Bug report logs - #520115 pam: CVE-2009-0887 integer signedness error could lead to DoS or authentication bypass Package: pam; Maintainer for pam is Steve Langasek <vorlon@debianorg>; Reported by: Nico Golde <nion@debianorg> Date: Tue, 17 Mar 2009 14:15:01 UTC Severity: important Tags: fixed-upstream, patch, ...

References

CWE-189http://openwall.com/lists/oss-security/2009/03/05/1http://pam.cvs.sourceforge.net/viewvc/pam/Linux-PAM/libpam/pam_misc.c?view=loghttp://www.securityfocus.com/bid/34010http://www.mandriva.com/security/advisories?name=MDVSA-2009:077http://secunia.com/advisories/34733https://www.redhat.com/archives/fedora-package-announce/2009-April/msg00398.htmlhttps://www.redhat.com/archives/fedora-package-announce/2009-April/msg00420.htmlhttps://exchange.xforce.ibmcloud.com/vulnerabilities/49110http://pam.cvs.sourceforge.net/viewvc/pam/Linux-PAM/libpam/pam_misc.c?r1=1.9&%3Br2=1.10&%3Bview=patchhttps://nvd.nist.govhttps://usn.ubuntu.com/1140-1/
CVSSv2
CVSSv2
CVSSv3
VMScore
Recommendations:
CVE-2024-3581reflected XSSCVE-2024-26925CVE-2024-27956LFICVE-2024-3607CVE-2024-3107CVE-2024-3295SQL
Vulnerability Notification Service
You don’t have to wait for vulnerability scanning results
Get Started

Vulmon Search

Vulmon Search is a vulnerability search engine. It gives comprehensive vulnerability information through a very simple user interface.

About

Home Recent Vulnerabilities Research Posts Trends Blog About Contact

Products

Vulmon Search Vulmon Research Vulmon Alerts Vulmap

Connect

Twitter Reddit Linkedin Facebook