ArchLinux: 202106-16: pam-u2f: authentication bypass | LinuxSecurit...

Advisories

Arch Linux Security Advisory ASA-202106-16
==========================================

Severity: Medium
Date    : 2021-06-01
CVE-ID  : CVE-2021-31924
Package : pam-u2f
Type    : authentication bypass
Remote  : No
Link    : https://security.archlinux.org/AVG-2001

Summary
=======

The package pam-u2f before version 1.1.1-1 is vulnerable to
authentication bypass.

Resolution
==========

Upgrade to 1.1.1-1.

# pacman -Syu "pam-u2f>=1.1.1-1"

The problem has been fixed upstream in version 1.1.1.

Workaround
==========

None.

Description
===========

Yubico pam-u2f before 1.1.1 has a logic issue that, depending on the
pam-u2f configuration and the application used, could lead to a local
PIN bypass. This issue does not allow user presence (touch) or
cryptographic signature verification to be bypassed, so an attacker
would still need to physically possess and interact with the YubiKey or
another enrolled authenticator.

If pam-u2f is configured to require PIN authentication, and the
application using pam-u2f allows the user to submit NULL as the PIN,
pam-u2f will attempt to perform a FIDO2 authentication without PIN. If
this authentication is successful, the PIN requirement is bypassed.

Impact
======

A local attacker could authenticate with a U2F device without having to
enter the correct PIN.

References
==========

https://www.yubico.com/support/security-advisories/ysa-2021-03/
https://github.com/Yubico/pam-u2f/issues/175
https://github.com/Yubico/pam-u2f/pull/180
https://github.com/Yubico/pam-u2f/commit/6059b057dd9b6d0164fc16f9422c0d728f902bb5
https://github.com/Yubico/pam-u2f/commit/1ffd435c9c26e8c3122ea121d3e0b55cb81b1a46
https://security.archlinux.org/CVE-2021-31924

ArchLinux: 202106-16: pam-u2f: authentication bypass

June 3, 2021
The package pam-u2f before version 1.1.1-1 is vulnerable to authentication bypass

Summary

Yubico pam-u2f before 1.1.1 has a logic issue that, depending on the pam-u2f configuration and the application used, could lead to a local PIN bypass. This issue does not allow user presence (touch) or cryptographic signature verification to be bypassed, so an attacker would still need to physically possess and interact with the YubiKey or another enrolled authenticator.
If pam-u2f is configured to require PIN authentication, and the application using pam-u2f allows the user to submit NULL as the PIN, pam-u2f will attempt to perform a FIDO2 authentication without PIN. If this authentication is successful, the PIN requirement is bypassed.

Resolution

Upgrade to 1.1.1-1.
# pacman -Syu "pam-u2f>=1.1.1-1"
The problem has been fixed upstream in version 1.1.1.

References

https://www.yubico.com/support/security-advisories/ysa-2021-03/ https://github.com/Yubico/pam-u2f/issues/175 https://github.com/Yubico/pam-u2f/pull/180 https://github.com/Yubico/pam-u2f/commit/6059b057dd9b6d0164fc16f9422c0d728f902bb5 https://github.com/Yubico/pam-u2f/commit/1ffd435c9c26e8c3122ea121d3e0b55cb81b1a46 https://security.archlinux.org/CVE-2021-31924

Severity
CVE-ID : CVE-2021-31924
Package : pam-u2f
Type : authentication bypass
Remote : No
Link : https://security.archlinux.org/AVG-2001

Impact

A local attacker could authenticate with a U2F device without having to enter the correct PIN.

Workaround

None.

Related News

We use cookies to provide and improve our services. By using our site, you consent to our Cookie Policy.