CVE-2011-4120 Auth bypass in yubico-pam
Remote attackers can bypass authentication and gain account access by providing a NULL password when the module is configured as sufficient without use_first_pass.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2011-4120?
CVE-2011-4120 is a critical authentication bypass vulnerability in Debian Debian Linux, published on 26 Nov 2019. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Yubico PAM Module before 2.10 performed user authentication when 'use_first_pass' PAM configuration option was not used and the module was configured as 'sufficient' in the PAM configuration. A remote attacker could use this flaw to circumvent common authentication process and obtain access to the account in question by providing a NULL value (pressing Ctrl-D keyboard sequence) as the password string.
Weakness: CWE-20
Which versions are affected by CVE-2011-4120?
It affects 2 products.
Products include Debian Debian Linux, Yubico Pam Module.
How do I fix CVE-2011-4120?
Upgrade to a fixed version.
Upgrade, and rotate credentials and sessions that may have been exposed. More about Authentication bypass.
Is CVE-2011-4120 being exploited?
There is no known exploitation of CVE-2011-4120 in the wild and no public exploit code.
Other vulnerabilities in Debian Debian Linux
Sources
Also known as DEBIAN-CVE-2011-4120, GHSA-4qc6-w2f8-x2pc.