Title: POP Password Changer Unauthorized Password Change Vulnerability
Severity: CRITICAL
Description:
POP Password Changer (poppassd_pam) is a server for changing system passwords. It uses PAM (Pluggable Authentication Modules).
poppassd_pam is reported prone to a vulnerability that may allow remote unauthorized users to change passwords. This issue can potentially allow an attacker to gain superuser privileges on a vulnerable computer.
Reportedly, the application does not check the validity of old passwords before changing a password. This occurs because the application does not call the 'pam_authenticate' function before calling 'pam_chauthtok'. A remote attacker can change the password for any user including the administrator.
A successful attack can allow for the compromise of all POP accounts. If shell access authentication is provided by the application, all server accounts may be compromised as well.
poppassd_pam 1.0 is affected by this vulnerability.
Affected Products:
- Gentoo Linux
- poppassd_ceti poppassd_ceti 1.0.0
- poppassd_pam poppassd_pam 1.0.0
References:
- POP Password Changer: poppassd_pam Product Page
Juniper Networks provides this content via a wide variety of sources and production methods. If notified of errors or omissions in the content of this page, Juniper Networks, at its discretion, will modify or remove the page or leave the content as is, depending on various factors including but not limited to the reputation and authority of the party providing the notification. Please use the contact information displayed elsewhere on this page to report any errors or omissions regarding the content on this page.
