CVE-2024-10963

A flaw was found in pam_access, where certain rules in its configuration file are mistakenly treated as hostnames. This vulnerability allows attackers to trick the system by pretending to be a trusted hostname, gaining unauthorized access. This issue poses a risk for systems that rely on this feature to control who can access certain services or terminals.

PAM (Pluggable Authentication Modules) is a system of libraries that handle the authentication tasks of applications (services) on the system.

Security Fix(es):

A vulnerability was found in pam_access due to the improper handling of tokens in access.conf, interpreted as hostnames. This flaw allows attackers to bypass access restrictions by spoofing hostnames, undermining configurations designed to limit access to specific TTYs or services. The flaw poses a risk in environments relying on these configurations for local access control.(CVE-2024-10963)

A flaw was found in pam_access, where certain rules in its configuration file are mistakenly treated as hostnames. This vulnerability allows attackers to trick the system by pretending to be a trusted hostname, gaining unauthorized access. This issue poses a risk for systems that rely on this feature to control who can access certain services or terminals.

Pluggable Authentication Modules (PAM) provide a system to set up authentication policies without the need to recompile programs to handle authentication.

Security Fix(es):

• pam: Improper Hostname Interpretation in pam_access Leads to Access Control Bypass (CVE-2024-10963)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Pluggable Authentication Modules (PAM) provide a system to set up authentication policies without the need to recompile programs to handle authentication.

Security Fix(es):

• pam: libpam: Libpam vulnerable to read hashed password (CVE-2024-10041)
• pam: Improper Hostname Interpretation in pam_access Leads to Access Control Bypass (CVE-2024-10963)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

A flaw was found in pam_access, where certain rules in its configuration file are mistakenly treated as hostnames. This vulnerability allows attackers to trick the system by pretending to be a trusted hostname, gaining unauthorized access. This issue poses a risk for systems that rely on this feature to control who can access certain services or terminals.

• CVE-2024-10963: fix a flaw found in pam_access, where certain rules in its configuration file are mistakenly treated as hostnames. There is the new 'nodns' option which should be enabled to fix the CVE.

• CVE-2024-10963: pam_access: rework resolving of tokens as hostname

These are all security issues fixed in the pam-1.7.0-2.1 package on the GA media of openSUSE Tumbleweed.

Pluggable Authentication Modules (PAM) provide a system to set up authentication policies without the need to recompile programs to handle authentication.

Security Fix(es):

• pam: Improper Hostname Interpretation in pam_access Leads to Access Control Bypass (CVE-2024-10963)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Pluggable Authentication Modules (PAM) provide a system to set up authentication policies without the need to recompile programs to handle authentication.

Security Fix(es):

• pam: libpam: Libpam vulnerable to read hashed password (CVE-2024-10041)

• pam: Improper Hostname Interpretation in pam_access Leads to Access Control Bypass (CVE-2024-10963)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

This update for pam fixes the following issues:

• CVE-2024-10963: Fixed improper hostname interpretation in pam_access that could lead to access control bypass (bsc#1233078).

This update for pam fixes the following issues:

• CVE-2024-10963: Fixed improper hostname interpretation inpam_access that could lead to access control bypass (bsc#1233078)

It was discovered that the PAM pam_access module incorrectly parsed certain rules as hostnames. An attacker could possibly use this issue to spoof hostnames and bypass access restrictions.