TUCoPS :: Linux :: Red Hat/Fedora

TUCoPS :: Linux :: Red Hat/Fedora :: ciacm009.txt
CIAC M-009 Red Hat linux PAM vulnerability

__________________________________________________________

The U.S. Department of Energy
Computer Incident Advisory Center
___ __ __ _ ___
/ | /_\ /
\___ __|__ / \ \___
__________________________________________________________

INFORMATION BULLETIN

Red Hat Linux PAM Vulnerability

October 23, 2001 19:00 GMT Number M-009
______________________________________________________________________________
PROBLEM: A software vulnerability exists in the PAM authentication
process. PAM authentication may not be properly enforced in
non-default setups.
PLATFORM: Red Hat Linux 7.1:
Alpha
i386
ia64
Red Hat Linux 7.2:
i386
DAMAGE: System users may receive the authentication credentials of other
users.
SOLUTION: Red Hat recommends that all users update to the latest package.
______________________________________________________________________________
VULNERABILITY The risk is MEDIUM. This vulnerability has been publicly
ASSESSMENT: announced.
______________________________________________________________________________
LINKS:
CIAC BULLETIN: http://www.ciac.org/ciac/bulletins/m007.shtml
ORIGINAL BULLETIN: http://www.redhat.com/support/errata/RHSA-2001-132.html
PATCHES: Red Hat Linux 7.1: SRPMS:
ftp://updates.redhat.com/7.1/en/os/SRPMS/util-linux-2.11f-11.7.1.src.rpm
alpha:
ftp://updates.redhat.com/7.1/en/os/alpha/util-linux-2.11f-11.7.1.alpha.rpm
i386:
ftp://updates.redhat.com/7.1/en/os/i386/util-linux-2.11f-11.7.1.i386.rpm
ia64:
ftp://updates.redhat.com/7.1/en/os/ia64/util-linux-2.11f-11.7.1.ia64.rpm
Red Hat Linux 7.2: SRPMS:
ftp://updates.redhat.com/7.2/en/os/SRPMS/util-linux-2.11f-12.src.rpm
i386:
ftp://updates.redhat.com/7.2/en/os/i386/util-linux-2.11f-12.i386.rpm
______________________________________________________________________________

[****** Begin Red Hat Bulletin ******]

---------------------------------------------------------------------
Red Hat, Inc. Red Hat Security Advisory

Synopsis: New util-linux packages available to fix /bin/login pam problem
Advisory ID: RHSA-2001:132-04
Issue date: 2001-10-11
Updated on: 2001-10-16
Product: Red Hat Linux
Keywords: login pam pam_limits
Cross references:
Obsoletes: RHSA-2001:095-04
---------------------------------------------------------------------

1. Topic:

New util-linux packages are available that fix a problem with /bin/login's
PAM implementation. This could, in some non-default setups, cause users to
receive credentials of other users. It is recommended that all users
update to the fixed packages.

2001-10-22: Packages are now available for Red Hat Linux 7.2. Notably,
these packages also fix the problem noted in RHSA-2001:095-04 (vipw
incorrectly setting permissions on some files) - this bug was accidentally
reintroduced in Red Hat Linux 7.2.

2. Relevant releases/architectures:

Red Hat Linux 7.1 - alpha, i386, ia64

Red Hat Linux 7.2 - i386

3. Problem description:

A problem existed in /bin/login's PAM implementation; it stored the value
of a static pwent buffer across PAM calls; when used with some PAM modules
in non-default configuration (such as pam_limits), it would overwrite the
buffer, causing a user to get credentials of another user.

Thanks go to Tarhon-Onu Victor <mituc@ac.tuiasi.ro> for bringing the
problem to our attention, and to Olaf Kirch <okir@caldera.de> for providing
the patch.

4. Solution:

Before applying this update, make sure all previously released errata
relevant to your system have been applied.

To update all RPMs for your particular architecture, run:

rpm -Fvh [filenames]

where [filenames] is a list of the RPMs you wish to upgrade. Only those
RPMs which are currently installed will be updated. Those RPMs which are
not installed but included in the list will not be updated. Note that you
can also use wildcards (*.rpm) if your current directory *only* contains
the
desired RPMs.

Please note that this update is also available via Red Hat Network. Many
people find this an easier way to apply updates. To use Red Hat Network,
launch the Red Hat Update Agent with the following command:

up2date

This will start an interactive process that will result in the appropriate
RPMs being upgraded on your system.

5. Bug IDs fixed (http://bugzilla.redhat.com/bugzilla for more info):

51646 - pam limits drops other user privileges

6. RPMs required:

Red Hat Linux 7.1:

SRPMS:
ftp://updates.redhat.com/7.1/en/os/SRPMS/util-linux-2.11f-11.7.1.src.rpm

alpha:
ftp://updates.redhat.com/7.1/en/os/alpha/util-linux-2.11f-11.7.1.alpha.rpm

i386:
ftp://updates.redhat.com/7.1/en/os/i386/util-linux-2.11f-11.7.1.i386.rpm

ia64:
ftp://updates.redhat.com/7.1/en/os/ia64/util-linux-2.11f-11.7.1.ia64.rpm

Red Hat Linux 7.2:

SRPMS:
ftp://updates.redhat.com/7.2/en/os/SRPMS/util-linux-2.11f-12.src.rpm

i386:
ftp://updates.redhat.com/7.2/en/os/i386/util-linux-2.11f-12.i386.rpm

7. Verification:

MD5 sum Package Name
--------------------------------------------------------------------------
db33b22f50978471a25fd5cc973f8f54 7.1/en/os/SRPMS/util-linux-2.11f-11.7.1.src.rpm
d55f6ec42e3c0268f2ab4decb24deb53 7.1/en/os/alpha/util-linux-2.11f-11.7.1.alpha.rpm
2bf1db1cadc50f783220f70aa2b7a09c 7.1/en/os/i386/util-linux-2.11f-11.7.1.i386.rpm
568c4ec61cb9cc0ebd6313fb14d0419c 7.1/en/os/ia64/util-linux-2.11f-11.7.1.ia64.rpm
3b5448a60fa6cb5580eb690a303827a5 7.2/en/os/SRPMS/util-linux-2.11f-12.src.rpm
c0f329c070e416fbb20c97670199d3fe 7.2/en/os/i386/util-linux-2.11f-12.i386.rpm

These packages are GPG signed by Red Hat, Inc. for security. Our key
is available at:
http://www.redhat.com/about/contact/pgpkey.html

You can verify each package with the following command:
rpm --checksig <filename>

If you only wish to verify that each package has not been corrupted or
tampered with, examine only the md5sum with the following command:
rpm --checksig --nogpg <filename>

8. References:

[****** End Red Hat Bulletin ******]

_______________________________________________________________________________

CIAC wishes to acknowledge the contributions of Red Hat, Inc. for the
information contained in this bulletin.
_______________________________________________________________________________

CIAC, the Computer Incident Advisory Center, is the computer
security incident response team for the U.S. Department of Energy
(DOE) and the emergency backup response team for the National
Institutes of Health (NIH). CIAC is located at the Lawrence Livermore
National Laboratory in Livermore, California. CIAC is also a founding
member of FIRST, the Forum of Incident Response and Security Teams, a
global organization established to foster cooperation and coordination
among computer security teams worldwide.

CIAC services are available to DOE, DOE contractors, and the NIH. CIAC
can be contacted at:
Voice: +1 925-422-8193 (7x24)
FAX: +1 925-423-8002
STU-III: +1 925-423-2604
E-mail: ciac@ciac.org

Previous CIAC notices, anti-virus software, and other information are
available from the CIAC Computer Security Archive.

World Wide Web: http://www.ciac.org/
Anonymous FTP: ftp.ciac.org

PLEASE NOTE: Many users outside of the DOE, ESnet, and NIH computing
communities receive CIAC bulletins. If you are not part of these
communities, please contact your agency's response team to report
incidents. Your agency's team will coordinate with CIAC. The Forum of
Incident Response and Security Teams (FIRST) is a world-wide
organization. A list of FIRST member organizations and their
constituencies can be obtained via WWW at http://www.first.org/.

This document was prepared as an account of work sponsored by an
agency of the United States Government. Neither the United States
Government nor the University of California nor any of their
employees, makes any warranty, express or implied, or assumes any
legal liability or responsibility for the accuracy, completeness, or
usefulness of any information, apparatus, product, or process
disclosed, or represents that its use would not infringe privately
owned rights. Reference herein to any specific commercial products,
process, or service by trade name, trademark, manufacturer, or
otherwise, does not necessarily constitute or imply its endorsement,
recommendation or favoring by the United States Government or the
University of California. The views and opinions of authors expressed
herein do not necessarily state or reflect those of the United States
Government or the University of California, and shall not be used for
advertising or product endorsement purposes.

LAST 10 CIAC BULLETINS ISSUED (Previous bulletins available from CIAC)

L-143: HP libsecurity Vulnerability
L-144: The W32.nimda Worm
M-001: Cisco Secure IDS Signature Obfuscation Vulnerability
M-002: Multi-Vendor format String Vulnerability in ToolTalk Service
M-003: Hewlett-Packard rpcbind Security Vulnerability
M-004: Excel and PowerPoint Macro Vulnerability
M-005: Office XP Error Reporting May Send Sensitive Documents to Microsoft
M-006: HP-UX telnetd Security Vulnerability
M-007: Macintosh OS-X Application Manager Vulnerability
M-008: Sun rpc yppasswdd Security Vulnerability