oss-security - CVE Request: libpam-sshauth: local root privilege escalation

Follow @Openwall on Twitter for new release announcements and other news

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Message-ID: <20160501054304.GA31390@eldamar.local>
Date: Sun, 1 May 2016 07:43:04 +0200
From: Salvatore Bonaccorso <carnil@...ian.org>
To: OSS Security Mailinglist <oss-security@...ts.openwall.com>
Subject: CVE Request: libpam-sshauth: local root privilege escalation

Hi

Due to a programming error, libpam-sshauth returned PAM_SUCCESS where
it should fail with PAM_AUTH_ERR. This was fixed in Debian in the last
upload to unstable with the attached patch.

Introduced with:
https://bazaar.launchpad.net/~ltsp-upstream/ltsp/libpam-sshauth/revision/93/src/pam_sshauth.c
Fixed by:
https://bazaar.launchpad.net/~ltsp-upstream/ltsp/libpam-sshauth/revision/114

Could you assign a CVE for this issue?

Regards,
Salvatore

View attachment "return-pam-auth-err-with-system-user" of type "text/plain" (714 bytes)

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.