Auth bypass in Canonical Ubuntu Linux

CVE-2009-3232

pam-auth-update for PAM, as used in Ubuntu 8.10 and 9.4, and Debian GNU/Linux, does not properly handle an "empty selection" for system authentication modules in certain rare configurations, which causes any attempt to be successful and allows remote attackers to bypass authentication.

Vulnerability class: Broken Authentication

EPSS: 0.046 (90.7th percentile) — read the EPSS interpretation.

Affected products

Canonical Ubuntu_linux — versions 8.10, 9.04
N/a — versions n/a

Weakness classification (CWE)

CWE-287 — Improper Authentication

References

cve@mitre.org (x_refsource_CONFIRM, Mailing List, Issue Tracking)
cve@mitre.org (x_refsource_CONFIRM, Patch, Issue Tracking)
cve@mitre.org (x_refsource_SECUNIA, Broken Link, Vendor Advisory, third-party-advisory)
cve@mitre.org (mailing-list, x_refsource_MLIST, Mailing List)
cve@mitre.org (Patch, VDB Entry, Third Party Advisory, vdb-entry, Broken Link, x_refsource_BID)
cve@mitre.org (x_refsource_UBUNTU, vendor-advisory, Broken Link)