Yubico PAM Module before 2.10 performed user authentication when 'use_first_pass' PAM configuration option was not used and the module was configured as 'sufficient' in the PAM configuration. A remote attacker could use this flaw to circumvent common authentication process and obtain access to the account in question by providing a NULL value (pressing Ctrl-D keyboard sequence) as the password string.
References
| Link | Resource |
|---|---|
| https://access.redhat.com/security/cve/cve-2011-4120 | Broken Link Third Party Advisory |
| https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2011-4120 | Issue Tracking Patch Third Party Advisory |
| https://security-tracker.debian.org/tracker/CVE-2011-4120 | Third Party Advisory |
| https://www.openwall.com/lists/oss-security/2011/11/07/6 | Mailing List Third Party Advisory |
| https://access.redhat.com/security/cve/cve-2011-4120 | Broken Link Third Party Advisory |
| https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2011-4120 | Issue Tracking Patch Third Party Advisory |
| https://security-tracker.debian.org/tracker/CVE-2011-4120 | Third Party Advisory |
| https://www.openwall.com/lists/oss-security/2011/11/07/6 | Mailing List Third Party Advisory |
Configurations
History
21 Nov 2024, 01:31
| Type | Values Removed | Values Added |
|---|---|---|
| References | () https://access.redhat.com/security/cve/cve-2011-4120 - Broken Link, Third Party Advisory | |
| References | () https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2011-4120 - Issue Tracking, Patch, Third Party Advisory | |
| References | () https://security-tracker.debian.org/tracker/CVE-2011-4120 - Third Party Advisory | |
| References | () https://www.openwall.com/lists/oss-security/2011/11/07/6 - Mailing List, Third Party Advisory |
Information
Published : 2019-11-26 05:15
Updated : 2024-11-21 01:31
NVD link : CVE-2011-4120
Mitre link : CVE-2011-4120
CVE.ORG link : CVE-2011-4120
JSON object : View
Products Affected
linux
- linux_kernel
yubico
- pam_module
debian
- debian_linux
CWE
CWE-20
Improper Input Validation