GLSA Advocate
Joined: 12 May 2004 Posts: 2663
|
Posted: Thu Jul 09, 2015 7:26 pm Post subject: [ GLSA 201507-09 ] PyPAM |
|
|
Gentoo Linux Security Advisory
Title: PyPAM: Arbitrary code execution (GLSA 201507-09)
Severity: normal
Exploitable: remote
Date: July 09, 2015
Bug(s): #407603
ID: 201507-09
Synopsis
A double free vulnerability in PyPAM could result in execution of
arbitrary code or Denial of Service.
Background
PyPAM is a PAM binding for Python.
Affected Packages
Package: dev-python/pypam
Vulnerable: < 0.5.0-r3
Unaffected: >= 0.5.0-r3
Architectures: All supported architectures
Description
PyPAM does not handle passwords correctly if there is NULL byte in the
string.
Impact
A remote attacker could possibly execute arbitrary code or cause a
Denial of Service condition.
Workaround
There is no known workaround at this time.
Resolution
All PyPAM users should upgrade to the latest version: Code: | # emerge --sync
# emerge --ask --oneshot --verbose ">=dev-python/pypam-0.5.0-r3"
|
References
CVE-2012-1502 |
|