Affected: AlmaLinux:9: pam, AlmaLinux:9: pam-devel, AlmaLinux:9: pam-docs

Pluggable Authentication Modules (PAM) provide a system to set up authentication policies without the need to recompile programs to handle authentication.

Security Fix(es):

* pam: Improper Hostname Interpretation in pam_access Leads to Access Control Bypass (CVE-2024-10963)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Affected: Alpaquita:stream: linux-pam

A flaw was found in pam_access, where certain rules in its configuration file are mistakenly treated as hostnames. This vulnerability allows attackers to trick the system by pretending to be a trusted hostname, gaining unauthorized access. This issue poses a risk for systems that rely on this feature to control who can access certain services or terminals.

A vulnerability was found in pam_access due to the improper handling of tokens in access.conf, interpreted as hostnames. This flaw allows attackers to bypass access restrictions by spoofing hostnames, undermining configurations designed to limit access to specific TTYs or services. The flaw poses a risk in environments relying on these configurations for local access control.

Affected: openEuler:22.03-LTS-SP1: pam, openEuler:24.03-LTS: pam, openEuler:22.03-LTS-SP4: pam, openEuler:22.03-LTS-SP3: pam, openEuler:20.03-LTS-SP4: pam

PAM (Pluggable Authentication Modules) is a system of libraries that handle the authentication tasks of applications (services) on the system. Security Fix(es): A vulnerability was found in pam_access due to the improper handling of tokens in access.conf, interpreted as hostnames. This flaw allows attackers to bypass access restrictions by spoofing hostnames, undermining configurations designed to limit access to specific TTYs or services. The flaw poses a risk in environments relying on these configurations for local access control.(CVE-2024-10963)

pam-1.7.0-2.1 on GA media

pam: Improper Hostname Interpretation in pam_access Leads to Access Control Bypass

Security update for pam

Affected: Ubuntu:24.04:LTS: pam

A flaw was found in pam_access, where certain rules in its configuration file are mistakenly treated as hostnames. This vulnerability allows attackers to trick the system by pretending to be a trusted hostname, gaining unauthorized access. This issue poses a risk for systems that rely on this feature to control who can access certain services or terminals.

Ein entfernter, anonymer Angreifer kann eine Schwachstelle in Red Hat Enterprise Linux ausnutzen, um Sicherheitsvorkehrungen zu umgehen.