Is this bug restricted to ubuntu or does it affect debian/rhel etc?

callahad · on July 8, 2010

I can't seem to replicate on a Debian unstable box, where pam hasn't been updated since April [0], but I don't have an Ubuntu box handy to verify that I'm properly trying to exploit it.

[0]: http://packages.qa.debian.org/p/pam.html

joeyh · on July 8, 2010

The security hole was introduced by a Ubuntu-specfic patch to pam. The pam_motd-legal-notice patch was added in July 2009 due to https://bugs.launchpad.net/ubuntu/+source/pam/+bug/399071