REDHAT-BUG-1038555: Low severity Linux-PAM pam_userdb vulnerability
It was found that in pamuserdb module for PAM, password hashes weren't compared case-sensitively, which could lead to acceptance of hashes for completely different passwords, which shouldn't be accepted.
After hashing the user's password with crypt(), pamuserdb compares the result to the stored hash case-insensitively with strncasecmp(), which should be avoided, as it could result in an increased possibility of a successful brute-force attack.
References: http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=731368
Affected Software
Event History
Frequently Asked Questions
What is the severity of REDHAT-BUG-1038555?
The severity of REDHAT-BUG-1038555 is considered high due to the potential for unauthorized access.
How do I fix REDHAT-BUG-1038555?
To fix REDHAT-BUG-1038555, you should update the pam_userdb module to a version where case-sensitive password hashing is correctly implemented.
What versions of pam_userdb are affected by REDHAT-BUG-1038555?
Versions of pam_userdb prior to the security patch addressing REDHAT-BUG-1038555 are affected.
What are the implications of REDHAT-BUG-1038555?
The implications of REDHAT-BUG-1038555 include a security risk that allows for the acceptance of incorrect password hashes.
Is there a workaround for REDHAT-BUG-1038555?
Currently, there is no official workaround for REDHAT-BUG-1038555; updating to the patched version is recommended.