pam_sm_authenticate in pam_pgsql.c in libpam-pgsql 0.6.3 does not properly consider operator precedence when evaluating the success of a pam_get_pass function call, which allows local users to gain privileges via a SIGINT signal when this function is executing, as demonstrated by a CTRL-C sequence at a sudo password prompt in an auth sufficient pam_pgsql.so configuration.
When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct.
| Name | Vendor | Start Version | End Version |
|---|---|---|---|
| Libpam-pgsql | Libpam-pgsql | 0.6.3 (including) | 0.6.3 (including) |
| Pam-pgsql | Ubuntu | dapper | * |
| Pam-pgsql | Ubuntu | devel | * |
| Pam-pgsql | Ubuntu | feisty | * |
| Pam-pgsql | Ubuntu | gutsy | * |
| Pam-pgsql | Ubuntu | hardy | * |
| Pam-pgsql | Ubuntu | intrepid | * |
| Pam-pgsql | Ubuntu | jaunty | * |
| Pam-pgsql | Ubuntu | karmic | * |
| Pam-pgsql | Ubuntu | upstream | * |