CVE-2009-0887

Integer signedness error in the _pam_StrTok function in libpam/pam_misc.c in Linux-PAM (aka pam) 1.0.3 and earlier, when a configuration file contains non-ASCII usernames, might allow remote attackers to cause a denial of service, and might allow remote authenticated users to obtain login access with a different user's non-ASCII username, via a login attempt.

Status

Show unmaintained releases

Package	Ubuntu Release	Status
pam	11.04 natty	Not affected
	10.10 maverick	Not affected
	10.04 LTS lucid	Not affected
	9.10 karmic	Not affected
	9.04 jaunty	Ignored end of life
	8.10 intrepid	Ignored end of life, was needed
	8.04 LTS hardy	Fixed 0.99.7.1-5ubuntu6.3
	7.10 gutsy	Ignored end of life, was needed
	6.06 LTS dapper	Ignored end of life

Patch details

For informational purposes only. We recommend not to cherry-pick updates. How can I get the fixes?

Package	Patch details
pam	Upstream: http://pam.cvs.sourceforge.net/viewvc/pam/Linux-PAM/libpam/pam_misc.c?r1=1.9&r2=1.9.2.1&pathrev=Linux-PAM-1_0-branch Upstream: http://pam.cvs.sourceforge.net/viewvc/pam/Linux-PAM/tests/Makefile.am?r1=1.5&r2=1.5.2.1&pathrev=Linux-PAM-1_0-branch Upstream: http://pam.cvs.sourceforge.net/viewvc/pam/Linux-PAM/tests/tst-pam_mkargv.c?r1=1.1&r2=1.1.2.3&pathrev=Linux-PAM-1_0-branch

References

Related Ubuntu Security Notices (USN)

USN-1140-1
PAM vulnerabilities
30 May 2011

Status

Patch details

References

Related Ubuntu Security Notices (USN)

Other references