n error in the handling of user names of Linux-PAM might allow remote
attackers to cause a Denial of Service or escalate privileges.


Background


Linux-PAM (Pluggable Authentication Modules) is an architecture
allowing the separation of the development of privilege granting
software from the development of secure and appropriate authentication
schemes.


Affected Packages

Package: sys-libs/pam
Vulnerable: < 1.0.4
Unaffected: >= 1.0.4
Architectures: All supported architectures


De******ion


Marcus Granado repoted that Linux-PAM does not properly handle user
names that contain Unicode characters. This is related to integer
signedness errors in the pam_StrTok() function in libpam/pam_misc.c.


Impact