The SELinux version of PAM before 0.78 r3 allows local users to perform brute force password guessing attacks via unix_chkpwd, which does not log failed guesses or delay its responses.
| Name | Vendor | Start Version | End Version |
|---|---|---|---|
| Pam | Pam | * | 0.80 (including) |
| Red Hat Enterprise Linux 4 | RedHat | pam-0:0.77-66.13 | * |