CVE-2008-2516

Publication date 3 June 2008

Last updated 24 July 2024

Ubuntu priority

Medium

Why this priority?

pam_sm_authenticate in pam_pgsql.c in libpam-pgsql 0.6.3 does not properly consider operator precedence when evaluating the success of a pam_get_pass function call, which allows local users to gain privileges via a SIGINT signal when this function is executing, as demonstrated by a CTRL-C sequence at a sudo password prompt in an "auth sufficient pam_pgsql.so" configuration.

Read the notes from the security team

Status

Package Ubuntu Release Status
pam-pgsql 9.10 karmic
Fixed 0.6.3-2build1
9.04 jaunty
Fixed 0.6.3-2build1
8.10 intrepid
Fixed 0.6.3-2build1
8.04 LTS hardy
Fixed 0.6.3-0ubuntu1.8.04.1
7.10 gutsy
Fixed 0.6.3-0ubuntu1.7.10.1
7.04 feisty Ignored end of life, was needed
6.06 LTS dapper Ignored end of life

Notes

wgrant

dapper, feisty are too old.