Vulnerability in checkpw - security update
Summary
DLA-191-1: checkpw - security update. Affects checkpw versions < 1.02-1+deb6u1. Fixed in 1.02-1+deb6u1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The checkpw package is a password authentication program used in Debian 6.0. It is responsible for verifying user credentials during the login process. This package plays a critical role in ensuring the security of user accounts and preventing unauthorized access to the system.
Vulnerability Detail
A flaw has been discovered in checkpw that affects account names containing double dashes. This vulnerability can be exploited by a remote attacker to cause a denial of service by triggering an infinite loop. By sending specially crafted account names, an attacker can force the checkpw program to continuously process the input, leading to a system resource exhaustion and rendering the system unresponsive.
How To Fix
Minimum fixed version
1.02-1+deb6u1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade checkpwTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability. It is essential to apply the security update as soon as possible to mitigate the risk of exploitation.
Conclusion
The checkpw package in Debian 6.0 is vulnerable to a denial of service attack due to a flaw in processing account names with double dashes. To mitigate this risk, it is crucial to update the checkpw package to version 1.02-1+deb6u1 or later. Failure to apply the security update may result in system resource exhaustion and potential unauthorized access to user accounts. For further assistance or support in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for checkpw →
FAQ
The vulnerability allows remote attackers to cause a denial of service by triggering an infinite loop in the checkpw program. This can lead to system resource exhaustion and render the system unresponsive.
You can use the Vulert Playground at Vulert Scanner to check if your system is affected by this vulnerability. Simply upload your package-lock.json file, and Vulert will analyze it for any open-source vulnerabilities, including this one.
At the time of this report, there are no known public exploits targeting this vulnerability. However, it is crucial to apply the security update to prevent any potential exploitation.
Yes, this vulnerability can be exploited remotely by sending specially crafted account names to the checkpw program.
The vulnerability was discovered by Hiroya Ito of GMO Pepabo, Inc. and reported to the Debian security team.
Related vulnerabilities
Recent vulnerabilities recorded for checkpw.
