Date: Sun, 1 May 2016 07:43:04 +0200 From: Salvatore Bonaccorso <carnil@...ian.org> To: OSS Security Mailinglist <oss-security@...ts.openwall.com> Subject: CVE Request: libpam-sshauth: local root privilege escalation Hi Due to a programming error, libpam-sshauth returned PAM_SUCCESS where it should fail with PAM_AUTH_ERR. This was fixed in Debian in the last upload to unstable with the attached patch. Introduced with: https://bazaar.launchpad.net/~ltsp-upstream/ltsp/libpam-sshauth/revision/93/src/pam_sshauth.c Fixed by: https://bazaar.launchpad.net/~ltsp-upstream/ltsp/libpam-sshauth/revision/114 Could you assign a CVE for this issue? Regards, Salvatore View attachment "return-pam-auth-err-with-system-user" of type "text/plain" (714 bytes)
Powered by blists - more mailing lists
Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.
Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.