[ GLSA 200606-18 ] PAM-MySQL: Multiple vulnerabilities

[GLSA]

Gentoo Linux Security Advisory

Title: PAM-MySQL: Multiple vulnerabilities (GLSA 200606-18)
Severity: normal
Exploitable: local
Date: June 15, 2006
Updated: July 29, 2006
Bug(s): #120842
ID: 200606-18

Synopsis


Vulnerabilities in PAM-MySQL can lead to a Denial of Service, making it
impossible to log into a machine.


Background


PAM-MySQL is a PAM module used to authenticate users against a MySQL
backend.


Affected Packages

Package: sys-auth/pam_mysql
Vulnerable: < 0.7_rc1
Unaffected: >= 0.7_rc1
Architectures: All supported architectures


Description


A flaw in handling the result of pam_get_item() as well as further
unspecified flaws were discovered in PAM-MySQL.


Impact


By exploiting the mentioned flaws an attacker can cause a Denial of
Service and thus prevent users that authenticate against PAM-MySQL from
logging into a machine. There is also a possible additional attack
vector with more malicious impact that has not been confirmed yet.


Workaround


There is no known workaround at this time.


Resolution


All PAM-MySQL users should upgrade to the latest version: