Описание
Yubico PAM Module before 2.10 performed user authentication when 'use_first_pass' PAM configuration option was not used and the module was configured as 'sufficient' in the PAM configuration. A remote attacker could use this flaw to circumvent common authentication process and obtain access to the account in question by providing a NULL value (pressing Ctrl-D keyboard sequence) as the password string.
Ссылки
- Broken LinkThird Party Advisory
- Issue TrackingPatchThird Party Advisory
- Third Party Advisory
- Mailing ListThird Party Advisory
- Broken LinkThird Party Advisory
- Issue TrackingPatchThird Party Advisory
- Third Party Advisory
- Mailing ListThird Party Advisory
Уязвимые конфигурации
Одновременно
Одно из
EPSS
9.8 Critical
CVSS3
7.5 High
CVSS2
Дефекты
Связанные уязвимости
Yubico PAM Module before 2.10 performed user authentication when 'use_ ...
Yubico PAM Module before 2.10 performed user authentication when 'use_first_pass' PAM configuration option was not used and the module was configured as 'sufficient' in the PAM configuration. A remote attacker could use this flaw to circumvent common authentication process and obtain access to the account in question by providing a NULL value (pressing Ctrl-D keyboard sequence) as the password string.
EPSS
9.8 Critical
CVSS3
7.5 High
CVSS2