Security
Security
A vulnerability has been found in Linux-PAM, allowing attackers to bypass the authentication process.
| Package | sys-libs/pam on all architectures |
|---|---|
| Affected versions | < 1.5.1 |
| Unaffected versions | >= 1.5.1 |
Linux-PAM (Pluggable Authentication Modules) is an architecture allowing the separation of the development of privilege granting software from the development of secure and appropriate authentication schemes.
A flaw was found in Linux-Pam in the way it handle empty passwords for non-existing users.
A remote attacker, who only needs to know a non-existing username, could bypass security restrictions and authenticate as root user.
Ensure that root account is protected by a non-empty password.
All Linux-PAM users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose ">=sys-libs/pam-1.5.1"
Release date
December 07, 2020
Latest revision
December 07, 2020: 1
Severity
normal
Exploitable
local, remote
Bugzilla entries