CVE-2018-17953 pam_access does not handle netmask matches correctly
A bug in SUSE's PAM access module causes access rules to fail open, allowing unauthorized users to bypass authentication restrictions.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2018-17953?
CVE-2018-17953 is a high-severity authentication bypass vulnerability in SUSE pam, published on 27 Nov 2018. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
A incorrect variable in a SUSE specific patch for pam_access rule matching in PAM 1.3.0 in openSUSE Leap 15.0 and SUSE Linux Enterprise 15 could lead to pam_access rules not being applied (fail open).
Weakness: CWE-284
Which versions are affected by CVE-2018-17953?
It affects 1 product.
Linux distribution packages (2)
pam SUSE:Linux Enterprise Module for Basesystem 15 | All versions | 1.3.0-6.6.1 |
pam SUSE:Linux Enterprise Module for Development Tools 15 | All versions | 1.3.0-6.6.1 |
Products include Kernel Linux-Pam.
How do I fix CVE-2018-17953?
Apply the vendor's patch.
Upgrade, and rotate credentials and sessions that may have been exposed. More about Authentication bypass.
Is CVE-2018-17953 being exploited?
There is no known exploitation of CVE-2018-17953 in the wild and no public exploit code.
Sources
Also known as GHSA-wwc4-7rwv-m5ch, SUSE-SU-2018:3965-1.