A vulnerability has been found in Linux-PAM, allowing attackers to bypass the authentication process.
|Package||sys-libs/pam on all architectures|
|Affected versions||< 1.5.1|
|Unaffected versions||>= 1.5.1|
Linux-PAM (Pluggable Authentication Modules) is an architecture allowing the separation of the development of privilege granting software from the development of secure and appropriate authentication schemes.
A flaw was found in Linux-Pam in the way it handle empty passwords for non-existing users.
A remote attacker, who only needs to know a non-existing username, could bypass security restrictions and authenticate as root user.
Ensure that root account is protected by a non-empty password.
All Linux-PAM users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose ">=sys-libs/pam-1.5.1"
December 07, 2020
December 07, 2020: 1