Inclusion of Sensitive Information in Log Files in pam_tacplus - CVE-2020-13881

Vulnerability details

The vulnerability allows a local user to gain access to sensitive information.

The vulnerability exists due to software stores TACACS+ encryption key into log file if the DEBUG loglevel and journald are used. A local user can read the log files and gain access to sensitive data. This information can be used to decrypt communication between the TACACS+ server and the end user, exposing authentication credentials.

Affected software

How to mitigate CVE-2020-13881

External References

• https://github.com/kravietz/pam_tacplus/issues/149
• https://github.com/kravietz/pam_tacplus/commit/4a9852c31c2fd0c0e72fbb689a586aabcfb11cb0
• http://www.openwall.com/lists/oss-security/2020/06/08/1
• https://lists.debian.org/debian-lts-announce/2020/06/msg00007.html
• https://www.arista.com/en/support/advisories-notices/security-advisories/11705-security-advisory-50
• https://usn.ubuntu.com/4521-1/
• https://lists.debian.org/debian-lts-announce/2021/08/msg00006.html

Related Security Bulletins

• Exposure of TACACS+ shared secret in pam_tacplus
• Arista CloudVision Portal update for pam_tacplus