severity 360657 important tags 360657 -security thanks On Mon, Apr 03, 2006 at 04:25:17PM -0600, dann frazier wrote: > reassign 360657 libpam0g > tag 360657 + patch > found 360657 0.79-3.1 > stop
> This patch works for me...
> --- pam-0.79/Linux-PAM/modules/pam_unix/pam_unix_passwd.c.orig
> 2006-04-03 16:06:46.000000000 -0600
> +++ pam-0.79/Linux-PAM/modules/pam_unix/pam_unix_passwd.c 2006-04-03
> 16:05:39.000000000 -0600
> @@ -1121,7 +1121,7 @@
> * password is acceptable.
> */
>
> - if (pass_new[0] == '\0') { /* "\0" password = NULL
> */
> + if (pass_new && pass_new[0] == '\0') { /* "\0"
> password = NULL */
> pass_new = NULL;
> }
> retval = _pam_unix_approve_pass(pamh, ctrl, pass_old,
> pass_new);
Thanks, Dann. FWIW, I don't see any way for a null dereference to be an
exploitable security hole, so I'm downgrading this bug and removing the
"security" tag.
Cheers,
--
Steve Langasek Give me a lever long enough and a Free OS
Debian Developer to set it on, and I can move the world.
[EMAIL PROTECTED] http://www.debian.org/
signature.asc
Description: Digital signature
