BugTraq
[ MDVSA-2010:220 ] pam Nov 04 2010 12:32PM
security mandriva com
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

_______________________________________________________________________

Mandriva Linux Security Advisory MDVSA-2010:220
http://www.mandriva.com/security/
_______________________________________________________________________

Package : pam
Date : November 4, 2010
Affected: 2009.0, 2009.1, 2010.0, 2010.1, Enterprise Server 5.0
_______________________________________________________________________

Problem Description:

Multiple vulnerabilities were discovered and corrected in pam:

The pam_xauth module did not verify the return values of the setuid()
and setgid() system calls. A local, unprivileged user could use this
flaw to execute the xauth command with root privileges and make it
read an arbitrary input file (CVE-2010-3316).

The pam_mail module used root privileges while accessing users'
files. In certain configurations, a local, unprivileged user could
use this flaw to obtain limited information about files or directories
that they do not have access to (CVE-2010-3435).

The pam_namespace module executed the external script namespace.init
with an unchanged environment inherited from an application calling
PAM. In cases where such an environment was untrusted (for example,
when pam_namespace was configured for setuid applications such as su
or sudo), a local, unprivileged user could possibly use this flaw to
escalate their privileges (CVE-2010-3853).

Packages for 2009.0 are provided as of the Extended Maintenance
Program. Please visit this link to learn more:
http://store.mandriva.com/product_info.php?cPath=149&products_id=490

The updated packages have been patched to correct these issues.
_______________________________________________________________________

References:

http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-3316
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-3435
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-3853
_______________________________________________________________________

Updated Packages:

Mandriva Linux 2009.0:
69786ba211f064d06465cc7b1495c2d3 2009.0/i586/libpam0-0.99.8.1-16.2mdv2009.0.i586.rpm
ad480c4220b456a3ea1c700e4aed85e4 2009.0/i586/libpam-devel-0.99.8.1-16.2mdv2009.0.i586.rpm
53657e6972a7c54172beda78dec01747 2009.0/i586/pam-0.99.8.1-16.2mdv2009.0.i586.rpm
badae4a2575ce217567a57caba4671e0 2009.0/i586/pam-doc-0.99.8.1-16.2mdv2009.0.i586.rpm
369f8fbf430e4e20ec2a049f2d5a8339 2009.0/SRPMS/pam-0.99.8.1-16.2mdv2009.0.src.rpm

Mandriva Linux 2009.0/X86_64:
35e03d6ab52fc14704180ff225ae0408 2009.0/x86_64/lib64pam0-0.99.8.1-16.2mdv2009.0.x86_64.rpm
a93abeab91371f20c1a190e6511ec499 2009.0/x86_64/lib64pam-devel-0.99.8.1-16.2mdv2009.0.x86_64.rpm
ef401ab8d6ca3fece20765f21e8a4b81 2009.0/x86_64/pam-0.99.8.1-16.2mdv2009.0.x86_64.rpm
3d3f1d915d7e2b43a66c9417fedcd945 2009.0/x86_64/pam-doc-0.99.8.1-16.2mdv2009.0.x86_64.rpm
369f8fbf430e4e20ec2a049f2d5a8339 2009.0/SRPMS/pam-0.99.8.1-16.2mdv2009.0.src.rpm

Mandriva Linux 2009.1:
c0c392fab146812a023e7633fe1ceeb7 2009.1/i586/libpam0-0.99.8.1-20.1mdv2009.1.i586.rpm
947d0b3b9b90a05ce3a9977c1436c57e 2009.1/i586/libpam-devel-0.99.8.1-20.1mdv2009.1.i586.rpm
4f99d7e29757bf81cc5cb60b5e01df48 2009.1/i586/pam-0.99.8.1-20.1mdv2009.1.i586.rpm
ca875c8c456de2772265f922187ca4b4 2009.1/i586/pam-doc-0.99.8.1-20.1mdv2009.1.i586.rpm
31264e4b3f73ed96678d159af6d2e07b 2009.1/SRPMS/pam-0.99.8.1-20.1mdv2009.1.src.rpm

Mandriva Linux 2009.1/X86_64:
1b31bd9af45b6355e153086bf16215de 2009.1/x86_64/lib64pam0-0.99.8.1-20.1mdv2009.1.x86_64.rpm
49b0cd7f2ebfcf3f051f1cfa1127bbe5 2009.1/x86_64/lib64pam-devel-0.99.8.1-20.1mdv2009.1.x86_64.rpm
95090c3f50e47129f973f86a85b827f2 2009.1/x86_64/pam-0.99.8.1-20.1mdv2009.1.x86_64.rpm
845484d6506e2ea62651932558822f63 2009.1/x86_64/pam-doc-0.99.8.1-20.1mdv2009.1.x86_64.rpm
31264e4b3f73ed96678d159af6d2e07b 2009.1/SRPMS/pam-0.99.8.1-20.1mdv2009.1.src.rpm

Mandriva Linux 2010.0:
6dd5a17484b94f93ba8a8cdc8a6994de 2010.0/i586/libpam0-1.1.0-6.1mdv2010.0.i586.rpm
7649cc7d3dd4f756cec888c18a279f94 2010.0/i586/libpam-devel-1.1.0-6.1mdv2010.0.i586.rpm
fb09c1526f0e43022aa09a53bda865a4 2010.0/i586/pam-1.1.0-6.1mdv2010.0.i586.rpm
52cb306b585052044bc896d8a092d6da 2010.0/i586/pam-doc-1.1.0-6.1mdv2010.0.i586.rpm
796383329dba07f3fa05e998e166cdfd 2010.0/SRPMS/pam-1.1.0-6.1mdv2010.0.src.rpm

Mandriva Linux 2010.0/X86_64:
cbc1a63c68a6e7928f165cb72b419c81 2010.0/x86_64/lib64pam0-1.1.0-6.1mdv2010.0.x86_64.rpm
f4649e861830739a84c6e034c5a02d92 2010.0/x86_64/lib64pam-devel-1.1.0-6.1mdv2010.0.x86_64.rpm
87fadece1f26a3a8fa81e13662f73835 2010.0/x86_64/pam-1.1.0-6.1mdv2010.0.x86_64.rpm
0486af7fd18e4cff4e2d1a0c454fdb7f 2010.0/x86_64/pam-doc-1.1.0-6.1mdv2010.0.x86_64.rpm
796383329dba07f3fa05e998e166cdfd 2010.0/SRPMS/pam-1.1.0-6.1mdv2010.0.src.rpm

Mandriva Linux 2010.1:
c2473140f61385cecdc8ef9ac88dc2e9 2010.1/i586/libpam0-1.1.1-2.1mdv2010.1.i586.rpm
7eec14ba49ec3297e7cfadadc67c3c9f 2010.1/i586/libpam-devel-1.1.1-2.1mdv2010.1.i586.rpm
912c5cda86fba68e867bef8db80d541c 2010.1/i586/pam-1.1.1-2.1mdv2010.1.i586.rpm
e64a7bbb0dd34cc24bcbab56135f80a5 2010.1/i586/pam-doc-1.1.1-2.1mdv2010.1.i586.rpm
c70e6904e0b740e408ee6bef1d932244 2010.1/SRPMS/pam-1.1.1-2.1mdv2010.1.src.rpm

Mandriva Linux 2010.1/X86_64:
c736e5498b71924f834104c6a2a1be46 2010.1/x86_64/lib64pam0-1.1.1-2.1mdv2010.1.x86_64.rpm
6cfabb68e6305e5d5491a4cad6c5fff3 2010.1/x86_64/lib64pam-devel-1.1.1-2.1mdv2010.1.x86_64.rpm
0724a47819b4409b3a819aae12588fe0 2010.1/x86_64/pam-1.1.1-2.1mdv2010.1.x86_64.rpm
247cd2094ce66f3e28e78927ed5d187e 2010.1/x86_64/pam-doc-1.1.1-2.1mdv2010.1.x86_64.rpm
c70e6904e0b740e408ee6bef1d932244 2010.1/SRPMS/pam-1.1.1-2.1mdv2010.1.src.rpm

Mandriva Enterprise Server 5:
1d08c70aaa1fdfabf369d3e9b7a89e65 mes5/i586/libpam0-0.99.8.1-16.2mdvmes5.1.i586.rpm
fd1f3904da9590669e00c5691759f91c mes5/i586/libpam-devel-0.99.8.1-16.2mdvmes5.1.i586.rpm
f56f1a78e2e00f770edef9694b91b9e2 mes5/i586/pam-0.99.8.1-16.2mdvmes5.1.i586.rpm
e8693a4476626d18db11316bb7fd9c83 mes5/i586/pam-doc-0.99.8.1-16.2mdvmes5.1.i586.rpm
3d07636e6b1208d0fbca2c0ab7d6093c mes5/SRPMS/pam-0.99.8.1-16.2mdvmes5.1.src.rpm

Mandriva Enterprise Server 5/X86_64:
5eefd3d906380879ad076d7da77dd29e mes5/x86_64/lib64pam0-0.99.8.1-16.2mdvmes5.1.x86_64.rpm
c6f5637f2e7c286138aa97c93aede29e mes5/x86_64/lib64pam-devel-0.99.8.1-16.2mdvmes5.1.x86_64.rpm
83f190e1bb31f79cfd4abe7abd2373aa mes5/x86_64/pam-0.99.8.1-16.2mdvmes5.1.x86_64.rpm
7223e7bda42555384e72cb5cdb51c795 mes5/x86_64/pam-doc-0.99.8.1-16.2mdvmes5.1.x86_64.rpm
3d07636e6b1208d0fbca2c0ab7d6093c mes5/SRPMS/pam-0.99.8.1-16.2mdvmes5.1.src.rpm
_______________________________________________________________________

To upgrade automatically use MandrivaUpdate or urpmi. The verification
of md5 checksums and GPG signatures is performed automatically for you.

All packages are signed by Mandriva for security. You can obtain the
GPG public key of the Mandriva Security Team by executing:

gpg --recv-keys --keyserver pgp.mit.edu 0x22458A98

You can view other update advisories for Mandriva Linux at:

http://www.mandriva.com/security/advisories

If you want to report vulnerabilities, please contact

security_(at)_mandriva.com
_______________________________________________________________________

Type Bits/KeyID Date User ID
pub 1024D/22458A98 2000-07-10 Mandriva Security Team
<security*mandriva.com>
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.9 (GNU/Linux)

iD8DBQFM0ncTmqjQ0CJFipgRAqNFAJ4yPDjEu3NR/hfuktfIRjaDG/g4UACcCsem
cCMZd7MopuesEKLGj+k6B8A=
=bth2
-----END PGP SIGNATURE-----

[ reply ]


 

Privacy Statement
Copyright 2010, SecurityFocus