CVE-2005-2949: pam_per_user before 0.4 does not verify if the user name changes between authentication attempts and uses t...

Security readout for executives and security teams

This flaw can let someone authenticate as a different user on systems using vulnerable pam_per_user configurations. The risk is business-significant because it affects login identity, but exposure appears narrow: it depends on pam_per_user before 0.4 and applications that allow the username to change during authentication. Likely exposure is limited to systems with pam_per_user installed before version 0.4 and used by authentication applications that permit username changes during authentication. The provided affected-product metadata is incomplete, so inventory confirmation is required. Prioritize systems where pam_per_user protects remote or privileged login paths. The issue targets authentication integrity, so unresolved exposure could enable unauthorized account access even though current exploitation evidence is not provided. Mitigation focus: Identify all systems using pam_per_user in PAM authentication stacks.; Upgrade pam_per_user from versions before 0.4 where supported by vendor packages.; Review vendor or distribution advisories for backported fixes..

Prepared

Jun 29, 2026, 17:57 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.