CVE-2009-0887: Medium severity Linux-PAM Linux-PAM vulnerability
Integer signedness error in the pamStrTok function in libpam/pammisc.c in Linux-PAM (aka pam) 1.0.3 and earlier, when a configuration file contains non-ASCII usernames, might allow remote attackers to cause a denial of service, and might allow remote authenticated users to obtain login access with a different user's non-ASCII username, via a login attempt.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
Ensure PAM configuration files and entries do not contain non-ASCII usernames. Replace or remove any non-ASCII usernames from PAM configuration files to avoid triggering the integer signedness error in _pam_StrTok in libpam/pam_misc.c (affects pam 1.0.3 and earlier).
SUSE PAM (libpam) configuration files usernames = ASCII-only (no non-ASCII characters)
Event History
Frequently Asked Questions
What is the severity of CVE-2009-0887?
CVE-2009-0887 is considered a high severity vulnerability due to its potential for denial of service and unauthorized access.
How do I fix CVE-2009-0887?
To fix CVE-2009-0887, upgrade your Linux-PAM to version 1.0.4 or later, which addresses this vulnerability.
What systems are affected by CVE-2009-0887?
CVE-2009-0887 affects multiple versions of Linux-PAM including versions up to and including 1.0.3.
Can CVE-2009-0887 be exploited remotely?
Yes, CVE-2009-0887 can be exploited by remote attackers to cause a denial of service.
What types of attacks are possible with CVE-2009-0887?
CVE-2009-0887 may allow remote authenticated users to gain unauthorized login access or cause a denial of service.