CVE-2016-20014
📋 TL;DR
This vulnerability in pam_tacplus before version 1.4.1 allows attackers to potentially access sensitive authentication data due to improper memory handling. The pam_sm_acct_mgmt function fails to zero out the arep data structure after use, which could leave authentication information in memory. Systems using pam_tacplus for TACACS+ authentication are affected.
💻 Affected Systems
- pam_tacplus
📦 What is this software?
Pam Tacplus by Pam Tacplus Project
⚠️ Risk & Real-World Impact
Worst Case
Attackers could extract sensitive authentication credentials or session data from memory, leading to complete system compromise and lateral movement.
Likely Case
Information disclosure of authentication-related data that could facilitate further attacks or credential theft.
If Mitigated
Limited impact if proper memory protection mechanisms and access controls are in place.
🎯 Exploit Status
Exploitation requires memory access and specific conditions to read leftover authentication data.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 1.4.1 and later
Vendor Advisory: https://github.com/kravietz/pam_tacplus/commit/e4c00eba70a0f72c4de77b5f072c69708ec2beab
Restart Required: No
Instructions:
1. Update pam_tacplus to version 1.4.1 or later. 2. Recompile and reinstall the PAM module. 3. No system restart required, but authentication services using pam_tacplus may need reloading.
🔧 Temporary Workarounds
Disable pam_tacplus
linuxTemporarily disable pam_tacplus module if not essential
# Comment out pam_tacplus lines in PAM configuration files
# Typically in /etc/pam.d/* files
🧯 If You Can't Patch
- Implement strict access controls to limit who can access systems using pam_tacplus
- Monitor for unusual authentication patterns or memory access attempts
🔍 How to Verify
Check if Vulnerable:
Check pam_tacplus version: 'pam_tacplus --version' or check installed package versionCheck Version:
pam_tacplus --version 2>/dev/null || rpm -q pam_tacplus || dpkg -l | grep pam-tacplusVerify Fix Applied:
Verify version is 1.4.1 or later and check PAM configuration files for pam_tacplus usage📡 Detection & Monitoring
Log Indicators:
- Unusual authentication failures
- Multiple authentication attempts
- Memory access errors in system logs
Network Indicators:
- Unusual TACACS+ traffic patterns
- Authentication requests from unexpected sources
SIEM Query:
source="*pam*" AND ("tacplus" OR "authentication failure")