CVE-2014-3879: Critical severity freebsd kernel vulnerability
OpenPAM Nummularia 9.2 through 10.0 does not properly handle the error reported when an include directive refers to a policy that does not exist, which causes the loaded policy chain to no be discarded and allows context-dependent attackers to bypass authentication via a login (1) without a password or (2) with an incorrect password.
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2014-3879?
CVE-2014-3879 has been classified as a high severity vulnerability due to its potential for allowing unauthorized access.
How do I fix CVE-2014-3879?
To fix CVE-2014-3879, update OpenPAM to a version above 10.0 that addresses the error handling issue.
Which versions of OpenPAM are affected by CVE-2014-3879?
OpenPAM versions 9.2 through 10.0 are affected by CVE-2014-3879.
What type of attack does CVE-2014-3879 facilitate?
CVE-2014-3879 allows context-dependent attackers to bypass authentication without a password.
Is FreeBSD affected by CVE-2014-3879?
Yes, FreeBSD versions up to and including 9.2 are affected by CVE-2014-3879.