Secunia

A vulnerability has been reported in pam-per-user, which can be exploited by malicious users to bypass certain security restrictions.

The vulnerability is caused due an error in checking whether the user name has been changed between calls to the authentication function. This causes pam-per-user to incorrectly use the same cached PAM "subrequest" handle between authentication calls.

Successful exploitation allows a malicious user to authenticate as other users (e.g. via /bin/login) using his own credentials.

Solution
Update to version 0.4.
Further details available in Customer Area

Provided and/or discovered by
The vendor credits Vijay Tandeker.

Changelog
Further details available in Customer Area

Deep Links
Links available in Customer Area