FreeBSD VuXML: Documenting security issues in FreeBSD and the FreeBSD Ports Collection

FreeBSD -- pam_ssh improperly grants access when user account has unencrypted SSH private keys

Affected packages
7.3 <= FreeBSD < 7.3_9
7.4 <= FreeBSD < 7.4_5
8.1 <= FreeBSD < 8.1_7
8.2 <= FreeBSD < 8.2_5

Details

VuXML ID eda151d8-4638-11e1-9f47-00e0815b8da8
Discovery 2011-12-23
Entry 2012-01-29
Modified 2013-06-18

Problem Description:

The OpenSSL library call used to decrypt private keys ignores the passphrase argument if the key is not encrypted. Because the pam_ssh module only checks whether the passphrase provided by the user is null, users with unencrypted SSH private keys may successfully authenticate themselves by providing a dummy passphrase.

[source]

References

FreeBSD Advisory SA-11:09.pam_ssh

Copyright © 2003-2005 Jacques Vidrine and contributors.
Please see the source of this document for full copyright information.