--===============8776628696495952325==
Content-Type: multipart/signed; micalg=pgp-sha512;
	protocol="application/pgp-signature";
 boundary="9jxsPFA5p3P2qPhR"
Content-Disposition: inline


--9jxsPFA5p3P2qPhR
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inlin
Content-Transfer-Encoding: quoted-printable

==========================================================================
Ubuntu Security Notice USN-2935-3
March 17, 2016

pam regression
==========================================================================

A security issue affects these releases of Ubuntu and its derivatives:

- Ubuntu 12.04 LTS

Summary:

USN-2935-1 introduced a regression in PAM.

Software Description:
- pam: Pluggable Authentication Modules

Details:

USN-2935-1 fixed vulnerabilities in PAM. The updates contained a packaging
change that prevented upgrades in certain multiarch environments. USN-2935-2
intended to fix the problem but was incomplete for Ubuntu 12.04 LTS. This
update fixes the problem in Ubuntu 12.04 LTS.

We apologize for the inconvenience.

Original advisory details:

 It was discovered that the PAM pam_userdb module incorrectly used a
 case-insensitive method when comparing hashed passwords. A local attacker
 could possibly use this issue to make brute force attacks easier. This
 issue only affected Ubuntu 12.04 LTS and Ubuntu 14.04 LTS. (CVE-2013-7041)
 
 Sebastian Krahmer discovered that the PAM pam_timestamp module incorrectly
 performed filtering. A local attacker could use this issue to create
 arbitrary files, or possibly bypass authentication. This issue only
 affected Ubuntu 12.04 LTS and Ubuntu 14.04 LTS. (CVE-2014-2583)
 
 Sebastien Macke discovered that the PAM pam_unix module incorrectly handled
 large passwords. A local attacker could possibly use this issue in certain
 environments to enumerate usernames or cause a denial of service.
 (CVE-2015-3238)

Update instructions:

The problem can be corrected by updating your system to the following
package versions:

Ubuntu 12.04 LTS:
  libpam-modules                  1.1.3-7ubuntu2.3

In general, a standard system update will make all the necessary changes.

References:
  http://www.ubuntu.com/usn/usn-2935-3
  http://www.ubuntu.com/usn/usn-2935-1
  http://www.ubuntu.com/usn/usn-2935-2, https://launchpad.net/bugs/1558597

Package Information:
  https://launchpad.net/ubuntu/+source/pam/1.1.3-7ubuntu2.3


--9jxsPFA5p3P2qPhR
Content-Type: application/pgp-signature; name="signature.asc"

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1

iQIcBAEBCgAGBQJW6xj1AAoJENaSAD2qAscK/3IP/2ETBK5j/jRXHOt94yg26KWd
NLTMNw+K7Qw/uFHI9u3qxVTQNQfKhZR6V4YldoS/o+XMs+6HKbNG3vqVtIb04YH4
J12kbLT/e49DfGfOQU1nyjuIaJbfII9aC+Y9ieXmxHHmXRK29otMrG8KQZwZ1boA
Ysc3pGcqZZo3migkedsEM2lxE7rYPkfRRmYGD2qqQcttBiZyYRJ2o1eE6NIWTWhs
aeH/9GvPHC+/k2DFT1CMfVLi+EtzLNe4sw/aEmufIDiQaYpWmoyUM7ohNwz7iWO5
QiIe0YEbJbAR2Yn3KaZKBBUk9toM81t1Wi21ZPQLh4F3TacMYVzkgkvMXdQ3jNEQ
dS8+bjgZxPH/4iysEzTY7IQngBZP6z2E5DHR0oFOS067Q6Atl65ikAMYTiHlYmFX
jIHoMiHcUVwz4wL0j4CoQCyBJoBx8KTdCQk9SPVMIX6+I/aqjHSsEvOWUGg/I3B9
UW2Sc/Kqdwytlsi92rdJKnwyN82ouCjXDt6CDbJWdckr+IhqgYvSvbJPV68Y4OkN
buUAEZfI4VGkZVDIoFMS9HYgBaVuhdGw95l8WphTf0/r6aNi2zn6LyZuiD/pVb+l
1fW2HcRJDn3oRTLkvkKRRyKeyv8lrf6jneyei8z6o2pnvENF7uCd4Bl5TnXU9jeQ
0KzrtGajoDqbJ0Zuf1ES
=W0NQ
-----END PGP SIGNATURE-----

--9jxsPFA5p3P2qPhR--


--===============8776628696495952325==
Content-Type: text/plain; charset="us-ascii"
MIME-Version: 1.0
Content-Transfer-Encoding: 7bit
Content-Disposition: inline

-- 
ubuntu-security-announce mailing list
ubuntu-security-announce@lists.ubuntu.com
Modify settings or unsubscribe at: https://lists.ubuntu.com/mailman/listinfo/ubuntu-security-announce

--===============8776628696495952325==--