CVE-2020-13881: 
Linux Debian vulnerability analysis and mitigation

CVE-2020-13881 is a security vulnerability discovered in pam_tacplus versions 1.3.8 through 1.5.1. The vulnerability involves the exposure of TACACS+ shared secrets in system logs when the DEBUG loglevel and journald are used. This issue was discovered in June 2020 and was reported by Adarsh Pandey from Arista Networks (GitHub Issue).

The vulnerability exists in the support.c file of pam_tacplus, where the TACACS+ shared secret (private server key) gets logged via syslog when DEBUG loglevel and journald are used. The issue was particularly concerning because the original README of pam_tacplus contained a configuration example with the debug parameter enabled, which may have led to widespread debug-mode deployments (OSS Security). The vulnerability has been assigned a CVSSv3.1 Base Score of 7.5, indicating a high severity level (Arista Advisory).

The exposure of TACACS+ shared secrets in system logs could allow attackers who gain access to these logs to decrypt and view all packets transmitted between the system and TACACS+ server. This could potentially expose sensitive information including user passwords and authentication data (Arista Advisory).

While this is a passive vulnerability that requires access to system logs, it could be exploited in man-in-the-middle attacks to decrypt TACACS+ traffic using the exposed shared secret. The vulnerability was particularly impactful in systems where debug logging was enabled based on the example configuration (OSS Security, Arista Advisory).

The vulnerability was fixed in pam_tacplus version 1.5.3 through upstream commit 4a9852c31c2fd0c0e72fbb689a586aabcfb11cb0, which prevents the logging of the secret. Various distributions also released security updates: Ubuntu provided fixes in version 1.3.8-2+deb8u1build0.20.04.1 for 20.04 LTS (Ubuntu Notice), and Debian released updates for multiple versions including 1.3.8-2+deb8u1 for Jessie (Debian LTS).