NVD Vulnerability Detail

CVE-2013-0191

Summary	libpam-pgsql (aka pam_pgsql) 0.7 does not properly handle a NULL value returned by the password search query, which allows remote attackers to bypass authentication via a crafted password.
Publication Date	June 3, 2014, 11:55 p.m.
Registration Date	Jan. 26, 2021, 3:32 p.m.
Last Update	Nov. 21, 2024, 10:47 a.m.

Affected software configurations

Configuration1		or higher	or less	more than	less than
cpe:2.3:a:lucas_clemente_vella:libpam-pgsql:0.7:::::::*

Related information, measures and tools

No	URL	タグ
1	http://lists.opensuse.org/opensuse-security-announce/2016-08/msg00010.html
2	http://lists.opensuse.org/opensuse-security-announce/2016-08/msg00010.html
3	http://lists.opensuse.org/opensuse-security-announce/2016-08/msg00040.html
4	http://lists.opensuse.org/opensuse-security-announce/2016-08/msg00040.html
5	http://seclists.org/oss-sec/2013/q1/86
6	http://seclists.org/oss-sec/2013/q1/86
7	http://seclists.org/oss-sec/2013/q1/99
8	http://seclists.org/oss-sec/2013/q1/99
9	http://sourceforge.net/p/pam-pgsql/bugs/13/
10	http://sourceforge.net/p/pam-pgsql/bugs/13/
11	http://sourceforge.net/u/lvella/pam-pgsql/ci/9361f5970e5dd90a747319995b67c2f73b91448c/	Exploit Patch
12	http://sourceforge.net/u/lvella/pam-pgsql/ci/9361f5970e5dd90a747319995b67c2f73b91448c/	Exploit Patch
13	http://www.securityfocus.com/bid/57440
14	http://www.securityfocus.com/bid/57440
15	https://exchange.xforce.ibmcloud.com/vulnerabilities/81363
16	https://exchange.xforce.ibmcloud.com/vulnerabilities/81363

Common Vulnerabilities List

No	CWE	Name	URL
1	CWE-287	不適切な認証	https://cwe.mitre.org/data/definitions/287.html

JVN Vulnerability Information

libpam-pgsql における認証を回避される脆弱性

Title	libpam-pgsql における認証を回避される脆弱性
Summary	libpam-pgsql (別名 pam_pgsql) は、パスワード検索クエリによって返される NULL 値を適切に処理しないため、認証を回避される脆弱性が存在します。
Possible impacts	第三者により、巧妙に細工されたパスワードを介して、認証を回避される可能性があります。
Solution	ベンダ情報および参考情報を参照して適切な対策を実施してください。
Publication Date	Jan. 15, 2013, midnight
Registration Date	June 5, 2014, 11:52 a.m.
Last Update	June 5, 2014, 11:52 a.m.

Affected System

libpam-pgsql

libpam-pgsql 0.7

CVE (情報セキュリティ共通脆弱性識別子)

No	Name	URL
Common Vulnerabilities and Exposures (CVE)
1	CVE-2013-0191	http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-0191
National Vulnerability Database (NVD)
2	CVE-2013-0191	http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2013-0191

CWE (共通脆弱性タイプ一覧)

No	Name	URL
JVNDB
1	CWE-287	https://jvndb.jvn.jp/ja/cwe/CWE-287.html

ベンダー情報

No	Name	URL
SourceForge
1	#13 It is possible to login with any password if query's password is null.	http://sourceforge.net/p/pam-pgsql/bugs/13/
2	libpam-pgsql	http://sourceforge.net/projects/pam-pgsql/

その他

No	Name	URL
関連文書
1	Failing authentication if password is null.	http://sourceforge.net/u/lvella/pam-pgsql/ci/9361f5970e5dd90a747319995b67c2f73b91448c/

Change Log

No	Changed Details	Date of change
0	[2014年06月05日] 掲載	Feb. 17, 2018, 10:37 a.m.