CVE-2009-0887

Publication date 12 March 2009

Last updated 24 July 2024

Integer signedness error in the _pam_StrTok function in libpam/pam_misc.c in Linux-PAM (aka pam) 1.0.3 and earlier, when a configuration file contains non-ASCII usernames, might allow remote attackers to cause a denial of service, and might allow remote authenticated users to obtain login access with a different user's non-ASCII username, via a login attempt.

Status

Show unmaintained releases

Package	Ubuntu Release	Status
pam	11.04 natty	Not affected
	10.10 maverick	Not affected
	10.04 LTS lucid	Not affected
	9.10 karmic	Not affected
	9.04 jaunty	Ignored
	8.10 intrepid	Ignored
	8.04 LTS hardy	Fixed 0.99.7.1-5ubuntu6.3
	7.10 gutsy	Ignored
	6.06 LTS dapper	Ignored

Patch details

For informational purposes only. We recommend not to cherry-pick updates. How can I get the fixes?

Package	Patch details
pam	Upstream: http://pam.cvs.sourceforge.net/viewvc/pam/Linux-PAM/libpam/pam_misc.c?r1=1.9&r2=1.9.2.1&pathrev=Linux-PAM-1_0-branch Upstream: http://pam.cvs.sourceforge.net/viewvc/pam/Linux-PAM/tests/Makefile.am?r1=1.5&r2=1.5.2.1&pathrev=Linux-PAM-1_0-branch Upstream: http://pam.cvs.sourceforge.net/viewvc/pam/Linux-PAM/tests/tst-pam_mkargv.c?r1=1.1&r2=1.1.2.3&pathrev=Linux-PAM-1_0-branch

References

Related Ubuntu Security Notices (USN)

USN-1140-1
PAM vulnerabilities
30 May 2011

CVE-2009-0887

Status

Patch details

References

Related Ubuntu Security Notices (USN)

Other references