NVD

Id
25128  
Name
CVE-2015-3238  
Description
The _unix_run_helper_binary function in the pam_unix module in Linux-PAM (aka pam) before 1.2.1, when unable to directly access passwords, allows local users to enumerate usernames or cause a denial of service (hang) via a large password.  
Reject
 
CVSS Version
2  
CVSS Score
5.8  
Severity
Medium  
CVSS Base Score
5.8  
CVSS Impact Subscore
4.9  
CVSS Exploit Subscore
8.6  
CVSS Vector
(AV:N/AC:M/Au:N/C:P/I:N/A:P)  
Pub Date
2017-01-19  
Published
2015-08-24  
Modified Date
2016-12-02  
Seq
2015-3238  

Actions

Related NVD References

Id NVD Id NVD No. Reference Actions
132888 25128 CVE-2015-3238 FEDORA-2015-10848  View
132889 25128 CVE-2015-3238 FEDORA-2015-10830  View
132890 25128 CVE-2015-3238 RHSA-2015:1640  View
132891 25128 CVE-2015-3238 [oss-security] 20150625 Linux-PAM 1.2.1 released to address CVE-2015-3238  View
132892 25128 CVE-2015-3238 http://www.oracle.com/technetwork/security-advisory/cpuapr2016v3-2985753.html  View
132893 25128 CVE-2015-3238 75428  View
132894 25128 CVE-2015-3238 USN-2935-1  View
132895 25128 CVE-2015-3238 USN-2935-2  View
132896 25128 CVE-2015-3238 USN-2935-3  View
132897 25128 CVE-2015-3238 https://bugzilla.redhat.com/show_bug.cgi?id=1228571  View
132898 25128 CVE-2015-3238 GLSA-201605-05  View
132899 25128 CVE-2015-3238 https://www.trustwave.com/Resources/Security-Advisories/Advisories/TWSL2015-011/?fid=6551  View
132900 25128 CVE-2015-3238 https://www.trustwave.com/Resources/SpiderLabs-Blog/Username-Enumeration-against-OpenSSH-SELinux-with-CVE-2015-3238/  View

Related JVN

Id Name Title Summary Cveinfo Name Cveinfo Id Nvdinfo Name Nvdinfo Id Cvssv2 Cvssv3 Jvnurl Published Date Last Updated Date Actions
9137 JVNDB-2015-004457 Linux-PAM の pam_unix モジュールの _unix_run_helper_binary 関数におけるユーザ名を列挙される脆弱性 Linux-PAM (別名 pam) の pam_unix モジュールの _unix_run_helper_binary 関数には、パスワードに直接アクセスできない場合、ユーザ名を列挙される、またはサービス運用妨害 (ハング) 状態にされる脆弱性が存在します。 CVE-2015-3238 80463 CVE-2015-3238 25128 5.8 6.5 http://jvndb.jvn.jp/ja/contents/2015/JVNDB-2015-004457.html 2015-06-15 2016-05-31 View