Joined: 12 May 2004
|Posted: Thu Jun 15, 2006 5:26 pm Post subject: [ GLSA 200606-18 ] PAM-MySQL: Multiple vulnerabilities
|Gentoo Linux Security Advisory
Title: PAM-MySQL: Multiple vulnerabilities (GLSA 200606-18)
Date: June 15, 2006
Updated: July 29, 2006
Vulnerabilities in PAM-MySQL can lead to a Denial of Service, making it
impossible to log into a machine.
PAM-MySQL is a PAM module used to authenticate users against a MySQL
Vulnerable: < 0.7_rc1
Unaffected: >= 0.7_rc1
Architectures: All supported architectures
A flaw in handling the result of pam_get_item() as well as further
unspecified flaws were discovered in PAM-MySQL.
By exploiting the mentioned flaws an attacker can cause a Denial of
Service and thus prevent users that authenticate against PAM-MySQL from
logging into a machine. There is also a possible additional attack
vector with more malicious impact that has not been confirmed yet.
There is no known workaround at this time.
All PAM-MySQL users should upgrade to the latest version:
|# emerge --sync
# emerge --ask --oneshot --verbose ">=sys-auth/pam_mysql-0.7_rc1"
Official release information
Last edited by GLSA on Mon Jan 20, 2014 5:28 am; edited 5 times in total