Security Update for libpam4j
Summary
DLA-1165-1: libpam4j - security update. Affects libpam4j versions < 1.4-2+deb7u1. Fixed in 1.4-2+deb7u1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
libpam4j is a Java binding for libpam.so, which provides a way for Java applications to authenticate users through the Pluggable Authentication Modules (PAM) framework. It allows Java programs to leverage the same authentication mechanisms used by the operating system. However, a vulnerability has been discovered in libpam4j that allows users with deactivated or disabled accounts to log in, even with a valid password.
Vulnerability Detail
The vulnerability in libpam4j arises from the failure to call the pam_acct_mgmt() function, which is responsible for verifying the PAM account. As a result, users with disabled or deactivated accounts can bypass the account verification process and gain unauthorized access to the system. This issue poses a significant security risk as it allows potential attackers to log in using valid credentials for disabled accounts.
How To Fix
Minimum fixed version
1.4-2+deb7u1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade libpam4jTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability. It is essential to apply the security update to libpam4j to mitigate the risk of unauthorized access.
Conclusion
The libpam4j package is vulnerable to a security issue that allows users with disabled or deactivated accounts to log in using valid credentials. To mitigate this risk, it is crucial to upgrade to the latest version of libpam4j. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for libpam4j →
FAQ
libpam4j is a Java binding for libpam.so, allowing Java applications to authenticate users through the PAM framework.
The vulnerability allows users with disabled or deactivated accounts to log in using valid credentials, posing a security risk.
To fix this vulnerability, upgrade the libpam4j package to version 1.4-2+deb7u1 or later.
No, there is no known workaround for this vulnerability. Applying the security update is the recommended solution.
You can find more information about Debian LTS security advisories, including how to apply updates and frequently asked questions, at https://wiki.debian.org/LTS.
Related vulnerabilities
Recent vulnerabilities recorded for libpam4j.
