CVE-2014-3879

Related Files

FreeBSD Security Advisory - PAM Policy Parser

Posted Jun 4, 2014

Site security.freebsd.org

FreeBSD Security Advisory - The OpenPAM library searches for policy definitions in several locations. While doing so, the absence of a policy file is a soft failure (handled by searching in the next location) while the presence of an invalid file is a hard failure (handled by returning an error to the caller). The policy parser returns the same error code (ENOENT) when a syntactically valid policy references a non-existent module as when the requested policy file does not exist. The search loop regards this as a soft failure and looks for the next similarly-named policy, without discarding the partially-loaded configuration. A similar issue can arise if a policy contains an include directive that refers to a non-existent policy.

tags | advisory

systems | freebsd

advisories | CVE-2014-3879

SHA-256 | c172f1629a0148dc04e340253e113146894af7408276fd65c6e6c6e3a50f19a6

Download | Favorite | View