Vulnerability Name:

CVE-2013-7041 (CCN-89588)

Assigned:2013-12-09
Published:2013-12-09
Updated:2016-12-03
Summary:The pam_userdb module for Pam uses a case-insensitive method to compare hashed passwords, which makes it easier for attackers to guess the password via a brute force attack.
CVSS v3 Severity:4.0 Medium (CCN CVSS v3.1 Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N)
Exploitability Metrics:Attack Vector (AV): Local
Attack Complexity (AC): Low
Privileges Required (PR): None
User Interaction (UI): None
Scope:Scope (S): Unchanged
Impact Metrics:Confidentiality (C): Low
Integrity (I): None
Availibility (A): None
CVSS v2 Severity:4.3 Medium (CVSS v2 Vector: AV:N/AC:M/Au:N/C:P/I:N/A:N)
3.2 Low (Temporal CVSS v2 Vector: AV:N/AC:M/Au:N/C:P/I:N/A:N/E:U/RL:OF/RC:C)
Exploitability Metrics:Access Vector (AV): Network
Access Complexity (AC): Medium
Authentication (Au): None
Impact Metrics:Confidentiality (C): Partial
Integrity (I): None
Availibility (A): None
2.1 Low (CCN CVSS v2 Vector: AV:L/AC:L/Au:N/C:P/I:N/A:N)
1.6 Low (CCN Temporal CVSS v2 Vector: AV:L/AC:L/Au:N/C:P/I:N/A:N/E:U/RL:OF/RC:C)
Exploitability Metrics:Access Vector (AV): Local
Access Complexity (AC): Low
Athentication (Au): None
Impact Metrics:Confidentiality (C): Partial
Integrity (I): None
Availibility (A): None
Vulnerability Type:CWE-310
Vulnerability Consequences:Other
References:Source: MITRE
Type: CNA
CVE-2013-7041

Source: CCN
Type: pam_userdb module for Pam Web site
pam_userdb

Source: CCN
Type: oss-sec Mailing List, Mon, 9 Dec 2013 18:48:12 -0500 (EST)
Re: CVE request: pam: password hashes aren't compared case-sensitively

Source: CCN
Type: IBM Security Bulletin T1024221 (Flex System Manager Node)
IBM Flex System Manager (FSM) is affected by a Pluggable Authentication Module (PAM) vulnerability (CVE-2013-7041)

Source: CCN
Type: IBM Security Bulletin N1021702 (Server Firmware, HMC and SDMC)
Vulnerabilities in PAM affect Power Hardware Management Console (CVE-2013-7041 and CVE-2015-3238)

Source: MLIST
Type: UNKNOWN
[oss-security] 20141209 Re: CVE request: pam: password hashes aren't compared case-sensitively

Source: MLIST
Type: UNKNOWN
[oss-security] 20141209 CVE request: pam: password hashes aren't compared case-sensitively

Source: BID
Type: UNKNOWN
64180

Source: CCN
Type: BID-64180
'pam_userdb' Module CVE-2013-7041 Password Hashes Security Weakness

Source: UBUNTU
Type: UNKNOWN
USN-2935-1

Source: UBUNTU
Type: UNKNOWN
USN-2935-2

Source: UBUNTU
Type: UNKNOWN
USN-2935-3

Source: CONFIRM
Type: UNKNOWN
https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=731368

Source: CCN
Type: Red Hat Bugzilla Bug 1038555
(CVE-2013-7041) CVE-2013-7041 pam: password hashes aren't compared case-sensitively

Source: CONFIRM
Type: UNKNOWN
https://bugzilla.redhat.com/show_bug.cgi?id=1038555

Source: XF
Type: UNKNOWN
pam-cve20137041-weak-security(89588)

Source: GENTOO
Type: UNKNOWN
GLSA-201605-05

Source: CCN
Type: WhiteSource Vulnerability Database
CVE-2013-7041

Vulnerable Configuration:Configuration 1:
  • cpe:/a:cristian_gafton:pam_userdb:-:*:*:*:*:*:*:*

    • * Denotes that component is vulnerable
    Oval Definitions
    Definition IDClassTitleLast Modified
    oval:org.opensuse.security:def:20137041
    V
    		CVE-2013-7041
    2022-05-20
    oval:org.opensuse.security:def:34011
    P
    		Security update for MozillaFirefox (Important)
    2021-12-12
    oval:org.opensuse.security:def:33059
    P
    		Security update for openssh (Important)
    2021-12-06
    oval:org.opensuse.security:def:34607
    P
    		Security update for the Linux Kernel (Important)
    2021-12-02
    oval:org.opensuse.security:def:30269
    P
    		Security update for postgresql96 (Important)
    2021-11-22
    oval:org.opensuse.security:def:30140
    P
    		Security update for qemu (Important)
    2021-10-28
    oval:org.opensuse.security:def:32199
    P
    		Security update for apache2 (Important)
    2021-10-06
    oval:org.opensuse.security:def:34549
    P
    		Security update for gd (Moderate)
    2021-09-23
    oval:org.opensuse.security:def:29421
    P
    		Security update for transfig (Moderate)
    2021-09-16
    oval:org.opensuse.security:def:30123
    P
    		Security update for file (Important)
    2021-09-02
    oval:org.opensuse.security:def:29404
    P
    		Security update for libsndfile (Critical)
    2021-08-05
    oval:org.opensuse.security:def:30103
    P
    		Security update for the Linux Kernel (Important)
    2021-07-20
    oval:org.opensuse.security:def:30212
    P
    		Security update for java-1_8_0-openjdk (Moderate)
    2021-06-15
    oval:org.opensuse.security:def:33927
    P
    		Security update for caribou (Important)
    2021-06-10
    oval:org.opensuse.security:def:31196
    P
    		Security update for spice (Important)
    2021-06-08
    oval:org.opensuse.security:def:36290
    P
    		sblim-sfcb-1.3.11-0.23.2 on GA media (Moderate)
    2021-06-08
    oval:org.opensuse.security:def:36248
    P
    		nagios-nrpe-2.12-24.4.10.1 on GA media (Moderate)
    2021-06-08
    oval:org.opensuse.security:def:33916
    P
    		Security update for dhcp (Important)
    2021-06-01
    oval:org.opensuse.security:def:33915
    P
    		Security update for djvulibre (Important)
    2021-05-31
    oval:org.opensuse.security:def:29365
    P
    		Security update for libxml2 (Important)
    2021-05-19
    oval:org.opensuse.security:def:32907
    P
    		Security update for gdm (Important)
    2021-04-28
    oval:org.opensuse.security:def:31353
    P
    		Security update for the Linux Kernel (Important)
    2021-03-09
    oval:org.opensuse.security:def:31352
    P
    		Security update for openldap2 (Important)
    2021-03-03
    oval:org.opensuse.security:def:29465
    P
    		Security update for python (Important)
    2021-02-11
    oval:org.opensuse.security:def:32238
    P
    		Security update for the Linux Kernel (Live Patch 36 for SLE 12 SP3) (Important)
    2021-02-10
    oval:org.opensuse.security:def:33002
    P
    		Security update for kernel-source (Important)
    2021-02-05
    oval:org.opensuse.security:def:34656
    P
    		Security update for MozillaFirefox (Important)
    2021-01-12
    oval:org.opensuse.security:def:31561
    P
    		Security update for postgresql12 (Important)
    2020-12-04
    oval:org.opensuse.security:def:35566
    P
    		ipsec-tools-0.7.3-1.1.93 on GA media (Moderate)
    2020-12-03
    oval:org.opensuse.security:def:35539
    P
    		emacs-22.3-4.32.4 on GA media (Moderate)
    2020-12-03
    oval:org.opensuse.security:def:35610
    P
    		log4net-1.2.10-1.36 on GA media (Moderate)
    2020-12-03
    oval:org.opensuse.security:def:32693
    P
    		kernel-default on GA media (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:29110
    P
    		Security update for java-1_7_0-ibm (Important)
    2020-12-01
    oval:org.opensuse.security:def:34695
    P
    		Security update for xorg-x11-libXp
    2020-12-01
    oval:org.opensuse.security:def:32682
    P
    		gzip on GA media (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:29026
    P
    		Security update for LibVNCServer (Important)
    2020-12-01
    oval:org.opensuse.security:def:32681
    P
    		gvim on GA media (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:28969
    P
    		Security update for orca (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:28883
    P
    		Security update for bind (Important)
    2020-12-01
    oval:org.opensuse.security:def:30715
    P
    		Security update for MozillaFirefox (Important)
    2020-12-01
    oval:org.opensuse.security:def:28752
    P
    		Security update for libmspack (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:34391
    P
    		Security update for unrar (Important)
    2020-12-01
    oval:org.opensuse.security:def:30671
    P
    		Security update for ImageMagick (Important)
    2020-12-01
    oval:org.opensuse.security:def:28683
    P
    		Security update for flash-player (Critical)
    2020-12-01
    oval:org.opensuse.security:def:34302
    P
    		Security update for quagga
    2020-12-01
    oval:org.opensuse.security:def:30652
    P
    		Security update for ImageMagick (Important)
    2020-12-01
    oval:org.opensuse.security:def:28672
    P
    		Security update for MozillaFirefox
    2020-12-01
    oval:org.opensuse.security:def:34245
    P
    		Security update for postgresql-init (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:30613
    P
    		Security update for stunnel
    2020-12-01
    oval:org.opensuse.security:def:28321
    P
    		Security update for pam (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:28671
    P
    		Security update for Mozilla Firefox
    2020-12-01
    oval:org.opensuse.security:def:34147
    P
    		Security update for opensc (Low)
    2020-12-01
    oval:org.opensuse.security:def:30564
    P
    		Security update for poppler
    2020-12-01
    oval:org.opensuse.security:def:28286
    P
    		Security update for mysql (Important)
    2020-12-01
    oval:org.opensuse.security:def:30509
    P
    		Security update for MozillaFirefox, mozilla-nspr (Important)
    2020-12-01
    oval:org.opensuse.security:def:30355
    P
    		Security update for w3m (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:35500
    P
    		Security update for postgresql-init (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:34192
    P
    		Security update for pam (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:35451
    P
    		Security update for perl (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:34152
    P
    		Security update for openssh (Low)
    2020-12-01
    oval:org.opensuse.security:def:35392
    P
    		Security update for opensc (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:29991
    P
    		Security update for libtasn1 (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:35232
    P
    		Security update for MySQL
    2020-12-01
    oval:org.opensuse.security:def:31517
    P
    		Security update for quagga (Important)
    2020-12-01
    oval:org.opensuse.security:def:29917
    P
    		Security update for libdb-4_5 (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:35142
    P
    		Security update for the Linux Kernel (Important)
    2020-12-01
    oval:org.opensuse.security:def:31496
    P
    		Security update for python-imaging
    2020-12-01
    oval:org.opensuse.security:def:29906
    P
    		Security update for lcms
    2020-12-01
    oval:org.opensuse.security:def:35085
    P
    		Security update for jpeg (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:31457
    P
    		Security update for postgresql91
    2020-12-01
    oval:org.opensuse.security:def:29905
    P
    		Security update for kvm (Important)
    2020-12-01
    oval:org.opensuse.security:def:34984
    P
    		Security update for ghostscript-library (Important)
    2020-12-01
    oval:org.opensuse.security:def:31408
    P
    		Security update for permissions (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:34848
    P
    		Security update for bind (Important)
    2020-12-01
    oval:org.opensuse.security:def:27648
    P
    		Security update for libxslt
    2020-12-01
    oval:org.opensuse.security:def:34764
    P
    		Security update for MozillaFirefox, mozilla-nspr, mozilla-nss (Important)
    2020-12-01
    oval:org.opensuse.security:def:27604
    P
    		Security update for Samba
    2020-12-01
    oval:org.opensuse.security:def:34753
    P
    		Security update for MozillaFirefox (Important)
    2020-12-01
    oval:org.opensuse.security:def:31109
    P
    		Security update for the Linux Kernel (Important)
    2020-12-01
    oval:org.opensuse.security:def:27590
    P
    		xorg-x11-server-sdk on GA media (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:35443
    P
    		Security update for pam (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:34752
    P
    		Security update for MozillaFirefox (Important)
    2020-12-01
    oval:org.opensuse.security:def:31052
    P
    		Security update for the Linux Kernel (Important)
    2020-12-01
    oval:org.opensuse.security:def:27551
    P
    		quagga on GA media (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:35402
    P
    		Security update for openssh (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:30960
    P
    		Security update for gpg2 (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:27502
    P
    		libwpd-0_8-8 on GA media (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:33514
    P
    		Security update for perl-IO-Socket-SSL
    2020-12-01
    oval:org.opensuse.security:def:30828
    P
    		Security update for curl (Important)
    2020-12-01
    oval:org.opensuse.security:def:27449
    P
    		libgnutls-devel on GA media (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:33470
    P
    		Security update for KVM
    2020-12-01
    oval:org.opensuse.security:def:30754
    P
    		Security update for apache2 (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:27298
    P
    		sudo on GA media (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:33447
    P
    		Security update for GhostScript
    2020-12-01
    oval:org.opensuse.security:def:30743
    P
    		Security update for ansible (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:27214
    P
    		libsamplerate on GA media (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:33408
    P
    		Security update for cobbler (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:31391
    P
    		Security update for pam (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:30742
    P
    		Security update for ansible (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:27157
    P
    		kdebase4-runtime on GA media (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:33359
    P
    		Security update for openssl1 (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:27076
    P
    		aaa_base on GA media (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:33302
    P
    		xorg-x11-libxcb-32bit on GA media (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:26948
    P
    		libexiv2-4 on GA media (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:33146
    P
    		libevent-1_4-2 on GA media (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:26884
    P
    		dhcpcd on GA media (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:26873
    P
    		clamav on GA media (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:26872
    P
    		cifs-utils on GA media (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:29316
    P
    		Security update for compat-openssl097g
    2020-12-01
    oval:org.opensuse.security:def:32772
    P
    		perl-spamassassin on GA media (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:29262
    P
    		Security update for wget (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:34720
    P
    		Security update for ImageMagick (Moderate)
    2020-12-01
    oval:com.ubuntu.precise:def:20137041000
    V
    		CVE-2013-7041 on Ubuntu 12.04 LTS (precise) - low.
    2014-05-08
    oval:com.ubuntu.trusty:def:20137041000
    V
    		CVE-2013-7041 on Ubuntu 14.04 LTS (trusty) - low.
    2014-05-08
    BACK
    cristian_gafton pam userdb -