Bug 1503103 (CVE-2017-12197)

Summary:	CVE-2017-12197 libpam4j: Account check bypass
Product:	[Other] Security Response	Reporter:	Adam Mariš <amaris>
Component:	vulnerability	Assignee:	Red Hat Product Security <security-response-team>
Status:	CLOSED ERRATA	QA Contact:
Severity:	medium	Docs Contact:
Priority:	medium
Version:	unspecified	CC:	apo, bdawidow, boliveir, chazlett, cheimes, drieden, java-sig-commits, mizdebsk, msrb, pdrozd, security-response-team, sthorger
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:		Doc Type:	If docs needed, set a value
Doc Text:	It was found that libpam4j did not properly validate user accounts when authenticating. A user with a valid password for a disabled account would be able to bypass security restrictions and possibly access sensitive information.	Story Points:	---
Clone Of:		Environment:
Last Closed:	2017-11-14 02:59:27 UTC	Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:	1511366, 1639395
Bug Blocks:	1491381

Description Adam Mariš 2017-10-17 11:42:06 UTC

PAM.authentication() does not call pam_acct_mgmt(). As a consequence, the PAM account is not properly verified. Any user with a valid password but with deactivated or disabled account is able to log in.

Comment 1 Adam Mariš 2017-10-17 11:42:13 UTC

Acknowledgments:

Name: Christian Heimes (Red Hat)

Comment 2 Chess Hazlett 2017-10-17 13:00:50 UTC

*** Bug 1502898 has been marked as a duplicate of this bug. ***

Comment 3 errata-xmlrpc 2017-10-17 19:43:10 UTC

This issue has been addressed in the following products:

  Red Hat Single Sign-On

Via RHSA-2017:2906 https://access.redhat.com/errata/RHSA-2017:2906

Comment 4 errata-xmlrpc 2017-10-17 19:54:11 UTC

This issue has been addressed in the following products:

  Red Hat Single Sign-On 7.1 for RHEL 6

Via RHSA-2017:2904 https://access.redhat.com/errata/RHSA-2017:2904

Comment 5 errata-xmlrpc 2017-10-17 19:54:42 UTC

This issue has been addressed in the following products:

  Red Hat Single Sign-On 7.1 for RHEL 7

Via RHSA-2017:2905 https://access.redhat.com/errata/RHSA-2017:2905

Comment 6 Markus Koschany 2017-11-03 20:00:47 UTC

Would it be possible to share the patch for this security issue or has someone forwarded it upstream already?

Comment 8 Chess Hazlett 2017-11-07 18:25:38 UTC

It's been resolved in upstream, keycloak 3.3.0.Final. [https://issues.jboss.org/browse/KEYCLOAK-5551]

Comment 9 Tomas Hoger 2017-11-09 09:00:45 UTC

Created libpam4j tracking bugs for this issue:

Affects: fedora-all [bug 1511366]

Comment 10 Chess Hazlett 2017-11-14 02:59:27 UTC

closing, this has been resolved in RHSSO and Fedora trackers filed.

Comment 11 Andrej Nemec 2018-10-15 15:38:01 UTC

Created jenkins-pam-auth-plugin tracking bugs for this issue:

Affects: fedora-all [bug 1639395]