The _unix_run_helper_binary function in the pam_unix module in Linux-PAM (aka pam) before 1.2.1, when unable to directly access passwords, allows local users to enumerate usernames or cause a denial of service (hang) via a large password.

The remote Redhat Enterprise Linux 5 host has one or more packages installed that are affected by multiple vulnerabilities that have been acknowledged by the vendor but will not be patched.

  - pam: DoS/user enumeration due to blocking pipe in pam_unix module (CVE-2015-3238)

  - The pam_userdb module for Pam uses a case-insensitive method to compare hashed passwords, which makes it     easier for attackers to guess the password via a brute force attack. (CVE-2013-7041)

  - Multiple directory traversal vulnerabilities in pam_timestamp.c in the pam_timestamp module for Linux-PAM     (aka pam) 1.1.8 allow local users to create arbitrary files or possibly bypass authentication via a ..
    (dot dot) in the (1) PAM_RUSER value to the get_ruser function or (2) PAM_TTY value to the check_tty     function, which is used by the format_timestamp_name function. (CVE-2014-2583)

Note that Nessus has not tested for these issues but has instead relied on the package manager's report that the package is installed.

According to the version of the pam package installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerability :

  - It was discovered that the _unix_run_helper_binary()     function of PAM's unix_pam module could write to a     blocking pipe, possibly causing the function to become     unresponsive. An attacker able to supply large     passwords to the unix_pam module could use this flaw to     enumerate valid user accounts, or cause a denial of     service on the system.(CVE-2015-3238)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update for pam fixes the following issues :

  - CVE-2015-3238: pam_unix in conjunction with SELinux     allowed for DoS attacks (bsc#934920).

  - log a hint to syslog if /etc/nologin is present, but     empty (bsc#1015565).

  - If /etc/nologin is present, but empty, log a hint to     syslog. (bsc#1015565)

  - Added support for libowcrypt.so, if present, to     configure support for BLOWFISH (bsc#1037824)

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update for pam fixes two security issues.

These security issues were fixed :

  - CVE-2015-3238: pam_unix in conjunction with SELinux     allowed for DoS attacks (bsc#934920).

  - CVE-2013-7041: Compare password hashes case-sensitively     (bsc#854480).

The update package also includes non-security fixes. See advisory for details.

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote host is affected by the vulnerability described in GLSA-201605-05 (Linux-PAM: Multiple vulnerabilities)

    Multiple vulnerabilities have been discovered in Linux-PAM.  Please       review the CVE identifiers referenced below for details.
  Impact :

    Remote attackers could cause Denial of Service, conduct brute-force attacks, and conduct username enumeration.
  Workaround :

    There is no known workaround at this time.

USN-2935-1 fixed vulnerabilities in PAM. The updates contained a packaging change that prevented upgrades in certain multiarch environments. USN-2935-2 intended to fix the problem but was incomplete for Ubuntu 12.04 LTS. This update fixes the problem in Ubuntu 12.04 LTS.

We apologize for the inconvenience.

It was discovered that the PAM pam_userdb module incorrectly used a case-insensitive method when comparing hashed passwords. A local attacker could possibly use this issue to make brute-force attacks easier. This issue only affected Ubuntu 12.04 LTS and Ubuntu 14.04 LTS. (CVE-2013-7041)

Sebastian Krahmer discovered that the PAM pam_timestamp module incorrectly performed filtering. A local attacker could use this issue to create arbitrary files, or possibly bypass authentication. This issue only affected Ubuntu 12.04 LTS and Ubuntu 14.04 LTS. (CVE-2014-2583)

Sebastien Macke discovered that the PAM pam_unix module incorrectly handled large passwords. A local attacker could possibly use this issue in certain environments to enumerate usernames or cause a denial of service. (CVE-2015-3238).

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote Ubuntu 14.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-2935-1 advisory.

    It was discovered that the PAM pam_userdb module incorrectly used a case-insensitive method when comparing     hashed passwords. A local attacker could possibly use this issue to make brute force attacks easier. This     issue only affected Ubuntu 12.04 LTS and Ubuntu 14.04 LTS. (CVE-2013-7041)

    Sebastian Krahmer discovered that the PAM pam_timestamp module incorrectly performed filtering. A local     attacker could use this issue to create arbitrary files, or possibly bypass authentication. This issue     only affected Ubuntu 12.04 LTS and Ubuntu 14.04 LTS. (CVE-2014-2583)

    Sebastien Macke discovered that the PAM pam_unix module incorrectly handled large passwords. A local     attacker could possibly use this issue in certain environments to enumerate usernames or cause a denial of     service. (CVE-2015-3238)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

It was discovered that the _unix_run_helper_binary() function of PAM's unix_pam module could write to a blocking pipe, possibly causing the function to become unresponsive. An attacker able to supply large passwords to the unix_pam module could use this flaw to enumerate valid user accounts, or cause a denial of service on the system.
(CVE-2015-3238)

An updated pam package that fixes one security issue is now available for Red Hat Enterprise Linux 6 and 7.

Red Hat Product Security has rated this update as having Moderate security impact. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available from the CVE link in the References section.

Pluggable Authentication Modules (PAM) provide a system whereby administrators can set up authentication policies without having to recompile programs to handle authentication.

It was discovered that the _unix_run_helper_binary() function of PAM's unix_pam module could write to a blocking pipe, possibly causing the function to become unresponsive. An attacker able to supply large passwords to the unix_pam module could use this flaw to enumerate valid user accounts, or cause a denial of service on the system.
(CVE-2015-3238)

Red Hat would like to thank Sebastien Macke of Trustwave SpiderLabs for reporting this issue.

All pam users are advised to upgrade to this updated package, which contains a backported patch to correct this issue.

The remote OracleVM system is missing necessary patches to address critical security updates :

  - fix CVE-2015-3238 - DoS due to blocking pipe with very     long password

  - make pam_pwhistory and pam_unix tolerant of opasswd file     corruption

  - pam_userdb: allow any crypt hash algorithm to be used     (#1119289)

  - pam_cracklib: improve documentation (#889233)

  - unbreak authentication if ld.so.preload is not empty

  - correct off by one error in account expiration     calculation (#947011)

  - pam_console_apply: do not print error if console.perms.d     is empty

  - properly handle all cases where crypt might return NULL     (#1026203)

  - pam_limits: clarify documentation of maxsyslogins limit     (#1028490)

  - pam_access: call DNS resolution only when necessary and     cache results (#1029817)

  - pam_limits: nofile applies to file descriptors not files     (#1040664)

  - pam_limits: check whether the utmp login entry is valid     (#1054936)

  - correct URLs in spec file (#1071770)

  - pam_userdb: correct the example in man page (#1078779)

  - pam_selinux: canonicalize username for getseuser     (#1083981)

  - pam_access: fix netgroup matching and @user@@netgroup     parsing (#740233)

  - pam_tty_audit: allow for runtime backwards compatibility     with old kernels

  - add option to pam_tty_audit to disable auditing of     password input

The remote Oracle Linux 6 / 7 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2015-1640 advisory.

    [1.1.1-20.1]
    - fix CVE-2015-3238 - DoS due to blocking pipe with very long password

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

Update fixing a minor security issue CVE-2015-3238.

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	Name	Product	Family	Severity
198919	RHEL 5 : pam (Unpatched Vulnerability)	Nessus	Red Hat Local Security Checks	medium
119066	EulerOS Virtualization 2.5.1 : pam (EulerOS-SA-2018-1375)	Nessus	Huawei Local Security Checks	medium
100408	SUSE SLED12 / SLES12 Security Update : pam (SUSE-SU-2017:1398-1)	Nessus	SuSE Local Security Checks	medium
93163	SUSE SLES11 Security Update : pam (SUSE-SU-2016:1645-1)	Nessus	SuSE Local Security Checks	medium
91378	GLSA-201605-05 : Linux-PAM: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	medium
90021	Ubuntu 12.04 LTS : pam regression (USN-2935-3)	Nessus	Ubuntu Local Security Checks	medium
89996	Ubuntu 14.04 LTS : PAM vulnerabilities (USN-2935-1)	Nessus	Ubuntu Local Security Checks	medium
88438	F5 Networks BIG-IP : PAM vulnerability (SOL17494)	Nessus	F5 Networks Local Security Checks	medium
85747	Amazon Linux AMI : pam (ALAS-2015-589)	Nessus	Amazon Linux Local Security Checks	medium
85564	Scientific Linux Security Update : pam on SL6.x, SL7.x i386/x86_64 (20150818)	Nessus	Scientific Linux Local Security Checks	medium
85530	RHEL 6 / 7 : pam (RHSA-2015:1640)	Nessus	Red Hat Local Security Checks	medium
85529	OracleVM 3.3 : pam (OVMSA-2015-0117)	Nessus	OracleVM Local Security Checks	medium
85526	Oracle Linux 6 / 7 : pam (ELSA-2015-1640)	Nessus	Oracle Linux Local Security Checks	medium
85516	CentOS 6 / 7 : pam (CESA-2015:1640)	Nessus	CentOS Local Security Checks	medium
84520	Fedora 21 : pam-1.1.8-19.fc21 (2015-10848)	Nessus	Fedora Local Security Checks	medium
84481	Fedora 22 : pam-1.1.8-19.fc22 (2015-10830)	Nessus	Fedora Local Security Checks	medium

Detections

Analytics

CVE-2015-3238

medium

Tenable Plugins

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium