CVE-2020-27743
📋 TL;DR
CVE-2020-27743 is a vulnerability in libtac within pam_tacplus where insufficient randomness checking for session IDs could allow attackers to predict or manipulate authentication sessions. This affects systems using pam_tacplus for TACACS+ authentication. The vulnerability could lead to authentication bypass or session hijacking.
💻 Affected Systems
- pam_tacplus
📦 What is this software?
Pam Tacplus by Pam Tacplus Project
⚠️ Risk & Real-World Impact
Worst Case
Complete authentication bypass allowing unauthorized access to systems using TACACS+ authentication, potentially leading to full system compromise.
Likely Case
Session hijacking or predictable session IDs enabling attackers to impersonate legitimate users in authentication flows.
If Mitigated
Limited impact if proper network segmentation and authentication monitoring are in place, though risk remains for authentication bypass.
🎯 Exploit Status
Exploitation requires understanding of TACACS+ protocol and ability to intercept or predict session IDs. No public exploits have been confirmed.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Version 1.5.2 and later
Vendor Advisory: https://github.com/kravietz/pam_tacplus/pull/163
Restart Required: Yes
Instructions:
1. Update pam_tacplus to version 1.5.2 or later. 2. Restart services using pam_tacplus. 3. Verify the fix by checking the version and testing authentication.
🔧 Temporary Workarounds
Disable pam_tacplus
linuxTemporarily disable TACACS+ authentication via pam_tacplus if not essential
# Comment out pam_tacplus lines in PAM configuration files
# Typically in /etc/pam.d/ files
Use alternative authentication
linuxSwitch to alternative authentication methods while patching
# Configure alternative PAM modules in /etc/pam.d/
🧯 If You Can't Patch
- Implement strict network segmentation to limit access to TACACS+ servers
- Enable detailed logging and monitoring of authentication attempts for anomaly detection
🔍 How to Verify
Check if Vulnerable:
Check pam_tacplus version: 'pam_tacplus --version' or check package manager. If version is 1.5.1 or earlier, system is vulnerable.Check Version:
pam_tacplus --version 2>/dev/null || dpkg -l | grep pam-tacplus || rpm -qa | grep pam-tacplusVerify Fix Applied:
Verify version is 1.5.2 or later and test TACACS+ authentication functionality.📡 Detection & Monitoring
Log Indicators:
- Failed TACACS+ authentication attempts with predictable patterns
- Unusual session ID sequences in authentication logs
Network Indicators:
- Unusual TACACS+ traffic patterns
- Authentication requests from unexpected sources
SIEM Query:
source="tacacs.log" AND (event_type="authentication" AND session_id matches predictable_pattern)