FreeBSD 9.2/10.0 PAM Module improper authentication

CVSS Meta Temp Score
CVSS is a standardized scoring system to determine possibilities of attacks. The Temp Score considers temporal factors like disclosure, exploit and countermeasures. The unique Meta Score calculates the average score of different sources to provide a normalized scoring system.
Current Exploit Price (≈)
Our analysts are monitoring exploit markets and are in contact with vulnerability brokers. The range indicates the observed or calculated exploit price to be seen on exploit markets. A good indicator to understand the monetary effort required for and the popularity of an attack.
CTI Interest Score
Our Cyber Threat Intelligence team is monitoring different web sites, mailing lists, exploit markets and social media networks. The CTI Interest Score identifies the interest of attackers and the security community for this specific vulnerability in real-time. A high score indicates an elevated risk to be targeted for this vulnerability.
7.1$0-$5k0.00

Summaryinfo

A vulnerability labeled as critical has been found in FreeBSD 9.2/10.0. Impacted is an unknown function of the component PAM Module. Such manipulation leads to improper authentication. This vulnerability is documented as CVE-2014-3879. There is not any exploit available. The affected component should be upgraded.

Detailsinfo

A vulnerability was found in FreeBSD 9.2/10.0 (Operating System). It has been rated as critical. Affected by this issue is an unknown part of the component PAM Module. The manipulation with an unknown input leads to a improper authentication vulnerability. Using CWE to declare the problem leads to CWE-287. When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct. Impacted is confidentiality, and integrity.

The weakness was released 06/03/2014 by Peter Wemm, Dag-Erling SmA and rgrav as FreeBSD-SA-14:13.pam as confirmed advisory (Website). The advisory is shared for download at security.FreeBSD.org. This vulnerability is handled as CVE-2014-3879 since 05/27/2014. The attack may be launched remotely. No form of authentication is required for exploitation. There are neither technical details nor an exploit publicly available. The advisory points out:

The OpenPAM library searches for policy definitions in several locations. While doing so, the absence of a policy file is a soft failure (handled by searching in the next location) while the presence of an invalid file is a hard failure (handled by returning an error to the caller). The policy parser returns the same error code (ENOENT) when a syntactically valid policy references a non-existent module as when the requested policy file does not exist. The search loop regards this as a soft failure and looks for the next similarly-named policy, without discarding the partially-loaded configuration. A similar issue can arise if a policy contains an include directive that refers to a non-existent policy.

The vulnerability scanner Nessus provides a plugin with the ID 92903 (FreeBSD : FreeBSD -- Incorrect error handling in PAM policy parser (6e8f9003-6007-11e6-a6c3-14dae9d210b8)), which helps to determine the existence of the flaw in a target environment. It is assigned to the family FreeBSD Local Security Checks.

Upgrading eliminates this vulnerability. Applying a patch is able to eliminate this problem. The bugfix is ready for download at security.FreeBSD.org. The best possible mitigation is suggested to be upgrading to the latest version. A possible mitigation has been published immediately after the disclosure of the vulnerability. The advisory contains the following remark:

If your system uses customized PAM policies, carefully review your policies to ensure that all module names are spelled correctly. If your system uses third-party authentication modules, either refrain from upgrading those modules until you have patched your system, or shut down the affected services before upgrading.

The vulnerability is also documented in the databases at X-Force (93610), Tenable (92903), SecurityFocus (BID 67808†), SecurityTracker (ID 1030330†) and Vulnerability Center (SBV-44757†). Once again VulDB remains the best source for vulnerability data.

Productinfo

Type

Name

Version

License

Website

CPE 2.3info

CPE 2.2info

CVSSv4info

VulDB Vector: 🔍
VulDB Reliability: 🔍

CVSSv3info

VulDB Meta Base Score: 8.1
VulDB Meta Temp Score: 7.7

VulDB Base Score: 6.5
VulDB Temp Score: 5.7
VulDB Vector: 🔍
VulDB Reliability: 🔍

NVD Base Score: 9.8
NVD Vector: 🔍

CVSSv2info

AVACAuCIA
💳💳💳💳💳💳
💳💳💳💳💳💳
💳💳💳💳💳💳
VectorComplexityAuthenticationConfidentialityIntegrityAvailability
UnlockUnlockUnlockUnlockUnlockUnlock
UnlockUnlockUnlockUnlockUnlockUnlock
UnlockUnlockUnlockUnlockUnlockUnlock

VulDB Base Score: 🔍
VulDB Temp Score: 🔍
VulDB Reliability: 🔍

NVD Base Score: 🔍

Exploitinginfo

Class: Improper authentication
CWE: CWE-287
CAPEC: 🔍
ATT&CK: 🔍

Physical: No
Local: No
Remote: Yes

Availability: 🔍
Status: Unproven

EPSS Score: 🔍
EPSS Percentile: 🔍

Price Prediction: 🔍
Current Price Estimation: 🔍

0-DayUnlockUnlockUnlockUnlock
TodayUnlockUnlockUnlockUnlock

Nessus ID: 92903
Nessus Name: FreeBSD : FreeBSD -- Incorrect error handling in PAM policy parser (6e8f9003-6007-11e6-a6c3-14dae9d210b8)
Nessus File: 🔍
Nessus Risk: 🔍
Nessus Family: 🔍

Threat Intelligenceinfo

Interest: 🔍
Active Actors: 🔍
Active APT Groups: 🔍

Countermeasuresinfo

Recommended: Upgrade
Status: 🔍

Reaction Time: 🔍
0-Day Time: 🔍
Exposure Time: 🔍

Patch: security.FreeBSD.org

Timelineinfo

05/27/2014 🔍
06/03/2014 +7 days 🔍
06/03/2014 +0 days 🔍
06/03/2014 +0 days 🔍
06/04/2014 +1 days 🔍
06/04/2014 +0 days 🔍
06/05/2014 +1 days 🔍
06/20/2021 +2572 days 🔍

Sourcesinfo

Product: freebsd.org

Advisory: FreeBSD-SA-14:13.pam
Researcher: Peter Wemm, Dag-Erling SmA, rgrav
Status: Confirmed
Confirmation: 🔍

CVE: CVE-2014-3879 (🔍)
GCVE (CVE): GCVE-0-2014-3879
GCVE (VulDB): GCVE-100-13436
X-Force: 93610 - FreeBSD OpenPAM library security bypass, Medium Risk
SecurityFocus: 67808 - FreeBSD OpenPAM Login Policy Parser Unauthorized Access Vulnerability
SecurityTracker: 1030330 - FreeBSD PAM Policy Parser Remote Authentication Bypass
Vulnerability Center: 44757 - FreeBSD 9.2 through 10 Remote Security Bypass in the OpenPAM Library, Medium

Entryinfo

Created: 06/04/2014 12:32
Updated: 06/20/2021 15:07
Changes: 06/04/2014 12:32 (65), 05/29/2017 10:34 (4), 06/20/2021 15:01 (3), 06/20/2021 15:03 (18), 06/20/2021 15:07 (1)
Complete: 🔍
Cache ID: 216:D31:103

Once again VulDB remains the best source for vulnerability data.

Discussion

No comments yet. Languages: en.

Please log in to comment.

◂ PreviousOverviewNext ▸

Do you want to use VulDB in your project?

Use the official API to access entries easily!