CVE-2011-4120
📋 TL;DR
This vulnerability in Yubico PAM Module allows authentication bypass when attackers provide a NULL password (Ctrl-D sequence). It affects systems using Yubico PAM Module for authentication without proper 'use_first_pass' configuration. Remote attackers can gain unauthorized access to user accounts.
💻 Affected Systems
- Yubico PAM Module
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Complete system compromise via unauthorized root or privileged user access, leading to data theft, system manipulation, or lateral movement.
Likely Case
Unauthorized access to user accounts with standard privileges, potentially leading to data exposure and privilege escalation.
If Mitigated
No impact if proper PAM configuration is used or patched version is installed.
🎯 Exploit Status
Exploit requires sending NULL password via Ctrl-D sequence; trivial to automate.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 2.10 and later
Vendor Advisory: https://access.redhat.com/security/cve/cve-2011-4120
Restart Required: No
Instructions:
1. Update Yubico PAM Module to version 2.10 or later using package manager. 2. For RedHat/CentOS: 'yum update pam_yubico'. 3. For Debian/Ubuntu: 'apt-get update && apt-get install libpam-yubico'. 4. Verify configuration after update.
🔧 Temporary Workarounds
Configure use_first_pass
linuxAdd 'use_first_pass' option to PAM configuration to prevent NULL password bypass
Edit /etc/pam.d/ files to include 'use_first_pass' for yubico module lines
Change PAM control flag
linuxChange yubico module from 'sufficient' to 'required' in PAM configuration
Edit /etc/pam.d/ files to change 'sufficient' to 'required' for yubico module
🧯 If You Can't Patch
- Implement network segmentation to restrict access to vulnerable systems
- Enable multi-factor authentication using additional methods beyond Yubico PAM
🔍 How to Verify
Check if Vulnerable:
Check PAM configuration files for yubico module without 'use_first_pass' and configured as 'sufficient'Check Version:
rpm -q pam_yubico # RedHat/CentOS
dpkg -l | grep pam-yubico # Debian/UbuntuVerify Fix Applied:
Verify Yubico PAM Module version is 2.10+ and test authentication with NULL password📡 Detection & Monitoring
Log Indicators:
- Authentication attempts with empty/null passwords
- Successful logins without proper Yubikey authentication
Network Indicators:
- Authentication requests with Ctrl-D sequences
- Rapid authentication attempts
SIEM Query:
source="auth.log" AND (password="" OR password=NULL) AND program="pam_yubico"🔗 References
- https://access.redhat.com/security/cve/cve-2011-4120
- https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2011-4120
- https://security-tracker.debian.org/tracker/CVE-2011-4120
- https://www.openwall.com/lists/oss-security/2011/11/07/6
- https://access.redhat.com/security/cve/cve-2011-4120
- https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2011-4120
- https://security-tracker.debian.org/tracker/CVE-2011-4120
- https://www.openwall.com/lists/oss-security/2011/11/07/6
