[Security Announce] [ MDKSA-2007:111 ] - Updated util-linux packages address login access policies bypassing issue

Posted by Bob on: 06/04/2007 11:05 PM [ Print | 0 comment(s) ]

The Mandriva Security Team published a new security update for Mandriva Linux. Here the announcement:

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

_______________________________________________________________________

Mandriva Linux Security Advisory MDKSA-2007:111
http://www.mandriva.com/security/
_______________________________________________________________________

Package : util-linux
Date : June 4, 2007
Affected: 2007.0, 2007.1, Corporate 3.0, Corporate 4.0,
Multi Network Firewall 2.0
_______________________________________________________________________

Problem Description:

login in util-linux-2.12a (and later versions) skips pam_acct_mgmt
and chauth_tok when authentication is skipped, such as when a
Kerberos krlogin session has been established, which might allow
users to bypass intended access policies that would be enforced by
pam_acct_mgmt and chauth_tok.

Updated packages have been patched to address this issue.
_______________________________________________________________________

References:

http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-7108
_______________________________________________________________________

Updated Packages:

Mandriva Linux 2007.0:
c6ccfda3e51f799be58d347a6252fc0d 2007.0/i586/losetup-2.12r-8.2mdv2007.0.i586.rpm
00677b03b96e27a2e04b1614cd717821 2007.0/i586/mount-2.12r-8.2mdv2007.0.i586.rpm
be40a7e5880fc2f2734aced382b973bf 2007.0/i586/util-linux-2.12r-8.2mdv2007.0.i586.rpm
a191a26c8a8bf8e09f9c2ed0f1355f45 2007.0/SRPMS/util-linux-2.12r-8.2mdv2007.0.src.rpm

Mandriva Linux 2007.0/X86_64:
3af6dbd097cd5f76876aaab20d0a460c 2007.0/x86_64/losetup-2.12r-8.2mdv2007.0.x86_64.rpm
944ba5000fbe19ff0aec7f7cb5e95f3b 2007.0/x86_64/mount-2.12r-8.2mdv2007.0.x86_64.rpm
8a9f34e7452785cb1b99428f4aa3e1c6 2007.0/x86_64/util-linux-2.12r-8.2mdv2007.0.x86_64.rpm
a191a26c8a8bf8e09f9c2ed0f1355f45 2007.0/SRPMS/util-linux-2.12r-8.2mdv2007.0.src.rpm

Mandriva Linux 2007.1:
dac84f6fd34e6390bf8895f499ea14c9 2007.1/i586/losetup-2.12r-12.1mdv2007.1.i586.rpm
6d8c238a5c8ab87221946cd2eea65b7e 2007.1/i586/mount-2.12r-12.1mdv2007.1.i586.rpm
c590331e6d863b2da097a0ce84dc1e6e 2007.1/i586/util-linux-2.12r-12.1mdv2007.1.i586.rpm
ed6995fcf07fe3e8a45c7cf168ef4b9e 2007.1/SRPMS/util-linux-2.12r-12.1mdv2007.1.src.rpm

Mandriva Linux 2007.1/X86_64:
a5164c59195655944cfa8a0b091954e5 2007.1/x86_64/losetup-2.12r-12.1mdv2007.1.x86_64.rpm
3b45cf9ba0a237f8102fe5b18fb287ea 2007.1/x86_64/mount-2.12r-12.1mdv2007.1.x86_64.rpm
c7643e7ccd4d6d6db7a8ec5a64c0abc3 2007.1/x86_64/util-linux-2.12r-12.1mdv2007.1.x86_64.rpm
ed6995fcf07fe3e8a45c7cf168ef4b9e 2007.1/SRPMS/util-linux-2.12r-12.1mdv2007.1.src.rpm

Corporate 3.0:
aeea368d87973112f486157eb8e7a392 corporate/3.0/i586/losetup-2.12-2.2.C30mdk.i586.rpm
5368318cb1d78cfe55ab380fbb892e35 corporate/3.0/i586/mount-2.12-2.2.C30mdk.i586.rpm
9823ba9ec1c0aa6cdcd8400adfae4067 corporate/3.0/i586/util-linux-2.12-2.2.C30mdk.i586.rpm
61dce5786fb8fcf8d47866a2f5ccac73 corporate/3.0/SRPMS/util-linux-2.12-2.2.C30mdk.src.rpm

Corporate 3.0/X86_64:
303222d2782ec741d3eec97393d24934 corporate/3.0/x86_64/losetup-2.12-2.2.C30mdk.x86_64.rpm
92952fcf2df3456c4c45378cd5c9d35d corporate/3.0/x86_64/mount-2.12-2.2.C30mdk.x86_64.rpm
394783ba574f715de60eb916656d08bf corporate/3.0/x86_64/util-linux-2.12-2.2.C30mdk.x86_64.rpm
61dce5786fb8fcf8d47866a2f5ccac73 corporate/3.0/SRPMS/util-linux-2.12-2.2.C30mdk.src.rpm

Corporate 4.0:
ef4ae1050f3db1223833665beaabc8b0 corporate/4.0/i586/losetup-2.12q-7.2.20060mlcs4.i586.rpm
a8d6eab630efed0f6fc762f187868698 corporate/4.0/i586/mount-2.12q-7.2.20060mlcs4.i586.rpm
a8fc8381718430bd75de652b11f39ae1 corporate/4.0/i586/util-linux-2.12q-7.2.20060mlcs4.i586.rpm
8f216edaf80c4320b27b0e4e4f93b78a corporate/4.0/SRPMS/util-linux-2.12q-7.2.20060mlcs4.src.rpm

Corporate 4.0/X86_64:
3aeec0f637c8e7ed452af857320c4eda corporate/4.0/x86_64/losetup-2.12q-7.2.20060mlcs4.x86_64.rpm
17dddbe7a339f5d0f97fc555fe945016 corporate/4.0/x86_64/mount-2.12q-7.2.20060mlcs4.x86_64.rpm
44fb996e88d86b74403e6a79f3a247fb corporate/4.0/x86_64/util-linux-2.12q-7.2.20060mlcs4.x86_64.rpm
8f216edaf80c4320b27b0e4e4f93b78a corporate/4.0/SRPMS/util-linux-2.12q-7.2.20060mlcs4.src.rpm

Multi Network Firewall 2.0:
6c6ee8df170f2045a0be93cf8941280b mnf/2.0/i586/losetup-2.12-2.2.M20mdk.i586.rpm
cf8a60bb88115e6f4d3076b5a1df50e5 mnf/2.0/i586/mount-2.12-2.2.M20mdk.i586.rpm
298e9d5915b752d32c8824c986ba8276 mnf/2.0/i586/util-linux-2.12-2.2.M20mdk.i586.rpm
d81106fb4614aab0ce85aac38b5c8231 mnf/2.0/SRPMS/util-linux-2.12-2.2.M20mdk.src.rpm
_______________________________________________________________________

To upgrade automatically use MandrivaUpdate or urpmi. The verification
of md5 checksums and GPG signatures is performed automatically for you.

All packages are signed by Mandriva for security. You can obtain the
GPG public key of the Mandriva Security Team by executing:

gpg --recv-keys --keyserver pgp.mit.edu 0x22458A98

You can view other update advisories for Mandriva Linux at:

http://www.mandriva.com/security/advisories

If you want to report vulnerabilities, please contact

security_(at)_mandriva.com
_______________________________________________________________________

Type Bits/KeyID Date User ID
pub 1024D/22458A98 2000-07-10 Mandriva Security Team
lt;security*mandriva.comgt;
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.7 (GNU/Linux)

iD8DBQFGZF//mqjQ0CJFipgRAh97AKD06kDRPPzB9rzi4U3jVjExa652KACeIMsV
1rIbbFCMjjjlkbUfJwKx9lI=
=eTga
-----END PGP SIGNATURE-----