pam_usb Deny Remote Feature Bypass Vulnerability in SSH Authentication

A vulnerability exists in pam_usb versions prior to 0.9.0, where the deny_remote feature incorrectly classifies IPv4-mapped IPv6 addresses as local. This misclassification allows an attacker with physical access to a registered USB device to authenticate over SSH as if they were at a local terminal, bypassing the intended remote authentication restrictions. The issue arises because the remote detection only checks the first word of the IPv6 address, leaving IPv4-mapped addresses unverified. This vulnerability is particularly relevant on systems with the SSH daemon configured to accept connections over IPv6.

Impact

Exploitation of this vulnerability allows for unauthorized authentication over SSH, bypassing local authentication requirements and potentially leading to unauthorized access on the affected system.

Remediation

Users can upgrade to pam_usb version 0.9.0 or later to address this vulnerability.