CVE-2009-0887

Integer signedness error in the _pam_StrTok function in libpam/pam_misc.c
in Linux-PAM (aka pam) 1.0.3 and earlier, when a configuration file
contains non-ASCII usernames, might allow remote attackers to cause a
denial of service, and might allow remote authenticated users to obtain
login access with a different user’s non-ASCII username, via a login
attempt.

Bugs

• <http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=520115&gt;
• <https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2009-0887&gt;