8e6899dea3
The "service" is blindly appended to config directories ("/etc/pam.d/"), and if a user can control the "service" it can get PAM to read config files from any location. This is not a problem with most software because the "service" is usually a constant string. The check protects 3rd party software from being abused. (CVE-2011-4122) |
||
---|---|---|
.. | ||
bzip2 | ||
dhcp | ||
ipf | ||
nvi | ||
openpam | ||
pdisk | ||
pf | ||
pppd | ||
smbfs |