-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1
- --------------------------------------------------------------------- Red Hat Security Advisory
Synopsis: Moderate: pam security, bug fix, and enhancement update Advisory ID: RHSA-2007:0737-02 Advisory URL: https://rhn.redhat.com/errata/RHSA-2007-0737.html Issue date: 2007-11-15 Updated on: 2007-11-15 Product: Red Hat Enterprise Linux Keywords: limits audit device ownership xauthority priority tally CVE Names: CVE-2007-1716 CVE-2007-3102 - ---------------------------------------------------------------------
1. Summary:
Updated pam packages that fix two security flaws, resolve two bugs, and add an enhancement are now available for Red Hat Enterprise Linux 4.
This update has been rated as having moderate security impact by the Red Hat Security Response Team.
2. Relevant releases/architectures:
Red Hat Enterprise Linux AS version 4 - i386, ia64, ppc, s390, s390x, x86_64 Red Hat Enterprise Linux Desktop version 4 - i386, x86_64 Red Hat Enterprise Linux ES version 4 - i386, ia64, x86_64 Red Hat Enterprise Linux WS version 4 - i386, ia64, x86_64
3. Problem description:
Pluggable Authentication Modules (PAM) provide a system whereby administrators can set up authentication policies without having to recompile programs that handle authentication.
A flaw was found in the way pam_console set console device permissions. It was possible for various console devices to retain ownership of the console user after logging out, possibly leaking information to another local user. (CVE-2007-1716)
A flaw was found in the way the PAM library wrote account names to the audit subsystem. An attacker could inject strings containing parts of audit messages, which could possibly mislead or confuse audit log parsing tools. (CVE-2007-3102)
As well, these updated packages fix the following bugs:
* the pam_xauth module, which is used for copying the X11 authentication cookie, did not reset the "XAUTHORITY" variable in certain circumstances, causing unnecessary delays when using su command.
* when calculating password similarity, pam_cracklib disregarded changes to the last character in passwords when "difok=x" (where "x" is the number of characters required to change) was configured in "/etc/pam.d/system-auth". This resulted in password changes that should have been successful to fail with the following error:
BAD PASSWORD: is too similar to the old one
This issue has been resolved in these updated packages.
* the pam_limits module, which provides setting up system resources limits for user sessions, reset the nice priority of the user session to "0" if it was not configured otherwise in the "/etc/security/limits.conf" configuration file.
These updated packages add the following enhancement:
* a new PAM module, pam_tally2, which allows accounts to be locked after a maximum number of failed log in attempts.
All users of PAM should upgrade to these updated packages, which resolve these issues and add this enhancement.
4. Solution:
Before applying this update, make sure that all previously-released errata relevant to your system have been applied.
This update is available via Red Hat Network. Details on how to use the Red Hat Network to apply this update are available at http://kbase.redhat.com/faq/FAQ_58_10188
5. Bug IDs fixed (http://bugzilla.redhat.com/):
228980 - XAUTHORITY env var not reset on 'su -' 230823 - CVE-2007-1716 Ownership of devices not returned to root after logout from console 247797 - CVE-2007-3102 audit logging of failed logins 267201 - pam_cracklib.so disregards changes to last char when calculating similarity
6. RPMs required:
Red Hat Enterprise Linux AS version 4:
SRPMS: ftp://updates.redhat.com/enterprise/4AS/en/os/SRPMS/pam-0.77-66.23.src.rpm 280fdb2b65b60c9f4289efbf9362f246 pam-0.77-66.23.src.rpm
i386: f83fa911b83700f7767907e20d7c4d45 pam-0.77-66.23.i386.rpm e9c41fa27b60845f56e15d63ac1335d0 pam-debuginfo-0.77-66.23.i386.rpm 7568bb0d75d41951a3956e1128787e78 pam-devel-0.77-66.23.i386.rpm
ia64: f83fa911b83700f7767907e20d7c4d45 pam-0.77-66.23.i386.rpm c23638544883ca4eccc5ac7a34af78bc pam-0.77-66.23.ia64.rpm e9c41fa27b60845f56e15d63ac1335d0 pam-debuginfo-0.77-66.23.i386.rpm 90fcc91636557a9c70a721e4d836f8dd pam-debuginfo-0.77-66.23.ia64.rpm e707127a2b6748373f521654333018e7 pam-devel-0.77-66.23.ia64.rpm
ppc: edb7fe8063315a76ef42285ec758fc49 pam-0.77-66.23.ppc.rpm a20e6dd507568b4e4d78734772d48013 pam-0.77-66.23.ppc64.rpm 45d2d248fbc8ffa2d8cbdaa232904b87 pam-debuginfo-0.77-66.23.ppc.rpm 331bdef816b228635bb5831343d4d03f pam-debuginfo-0.77-66.23.ppc64.rpm dff686e760e6db61bcd5e526dbc37415 pam-devel-0.77-66.23.ppc.rpm d60805d695d5f00b15dd61a2f4547fb4 pam-devel-0.77-66.23.ppc64.rpm
s390: 7e14ae2d5fae071fdc976b59d0bd7503 pam-0.77-66.23.s390.rpm 81b0d2a8642fda0e80109e9bcd93d981 pam-debuginfo-0.77-66.23.s390.rpm 1e69ba88bb46d7b087c65330b26140fa pam-devel-0.77-66.23.s390.rpm
s390x: 7e14ae2d5fae071fdc976b59d0bd7503 pam-0.77-66.23.s390.rpm 37d92cc5118f527d7257be350edc8934 pam-0.77-66.23.s390x.rpm 81b0d2a8642fda0e80109e9bcd93d981 pam-debuginfo-0.77-66.23.s390.rpm 0f3d8a73291ad04c89cce34f32a1589c pam-debuginfo-0.77-66.23.s390x.rpm 1e69ba88bb46d7b087c65330b26140fa pam-devel-0.77-66.23.s390.rpm 5e7853af7d8905b4375f68bca57da149 pam-devel-0.77-66.23.s390x.rpm
x86_64: f83fa911b83700f7767907e20d7c4d45 pam-0.77-66.23.i386.rpm 03ec1abab5c5ab9395d59b70c7f4ec36 pam-0.77-66.23.x86_64.rpm e9c41fa27b60845f56e15d63ac1335d0 pam-debuginfo-0.77-66.23.i386.rpm 0a8738a21ed748b168cc9f55a61ab423 pam-debuginfo-0.77-66.23.x86_64.rpm 7568bb0d75d41951a3956e1128787e78 pam-devel-0.77-66.23.i386.rpm 1e5df76e71f24d346b4bd55e00cdaf0c pam-devel-0.77-66.23.x86_64.rpm
Red Hat Enterprise Linux Desktop version 4:
SRPMS: ftp://updates.redhat.com/enterprise/4Desktop/en/os/SRPMS/pam-0.77-66.23.src.rpm 280fdb2b65b60c9f4289efbf9362f246 pam-0.77-66.23.src.rpm
i386: f83fa911b83700f7767907e20d7c4d45 pam-0.77-66.23.i386.rpm e9c41fa27b60845f56e15d63ac1335d0 pam-debuginfo-0.77-66.23.i386.rpm 7568bb0d75d41951a3956e1128787e78 pam-devel-0.77-66.23.i386.rpm
x86_64: f83fa911b83700f7767907e20d7c4d45 pam-0.77-66.23.i386.rpm 03ec1abab5c5ab9395d59b70c7f4ec36 pam-0.77-66.23.x86_64.rpm e9c41fa27b60845f56e15d63ac1335d0 pam-debuginfo-0.77-66.23.i386.rpm 0a8738a21ed748b168cc9f55a61ab423 pam-debuginfo-0.77-66.23.x86_64.rpm 7568bb0d75d41951a3956e1128787e78 pam-devel-0.77-66.23.i386.rpm 1e5df76e71f24d346b4bd55e00cdaf0c pam-devel-0.77-66.23.x86_64.rpm
Red Hat Enterprise Linux ES version 4:
SRPMS: ftp://updates.redhat.com/enterprise/4ES/en/os/SRPMS/pam-0.77-66.23.src.rpm 280fdb2b65b60c9f4289efbf9362f246 pam-0.77-66.23.src.rpm
i386: f83fa911b83700f7767907e20d7c4d45 pam-0.77-66.23.i386.rpm e9c41fa27b60845f56e15d63ac1335d0 pam-debuginfo-0.77-66.23.i386.rpm 7568bb0d75d41951a3956e1128787e78 pam-devel-0.77-66.23.i386.rpm
ia64: f83fa911b83700f7767907e20d7c4d45 pam-0.77-66.23.i386.rpm c23638544883ca4eccc5ac7a34af78bc pam-0.77-66.23.ia64.rpm e9c41fa27b60845f56e15d63ac1335d0 pam-debuginfo-0.77-66.23.i386.rpm 90fcc91636557a9c70a721e4d836f8dd pam-debuginfo-0.77-66.23.ia64.rpm e707127a2b6748373f521654333018e7 pam-devel-0.77-66.23.ia64.rpm
x86_64: f83fa911b83700f7767907e20d7c4d45 pam-0.77-66.23.i386.rpm 03ec1abab5c5ab9395d59b70c7f4ec36 pam-0.77-66.23.x86_64.rpm e9c41fa27b60845f56e15d63ac1335d0 pam-debuginfo-0.77-66.23.i386.rpm 0a8738a21ed748b168cc9f55a61ab423 pam-debuginfo-0.77-66.23.x86_64.rpm 7568bb0d75d41951a3956e1128787e78 pam-devel-0.77-66.23.i386.rpm 1e5df76e71f24d346b4bd55e00cdaf0c pam-devel-0.77-66.23.x86_64.rpm
Red Hat Enterprise Linux WS version 4:
SRPMS: ftp://updates.redhat.com/enterprise/4WS/en/os/SRPMS/pam-0.77-66.23.src.rpm 280fdb2b65b60c9f4289efbf9362f246 pam-0.77-66.23.src.rpm
i386: f83fa911b83700f7767907e20d7c4d45 pam-0.77-66.23.i386.rpm e9c41fa27b60845f56e15d63ac1335d0 pam-debuginfo-0.77-66.23.i386.rpm 7568bb0d75d41951a3956e1128787e78 pam-devel-0.77-66.23.i386.rpm
ia64: f83fa911b83700f7767907e20d7c4d45 pam-0.77-66.23.i386.rpm c23638544883ca4eccc5ac7a34af78bc pam-0.77-66.23.ia64.rpm e9c41fa27b60845f56e15d63ac1335d0 pam-debuginfo-0.77-66.23.i386.rpm 90fcc91636557a9c70a721e4d836f8dd pam-debuginfo-0.77-66.23.ia64.rpm e707127a2b6748373f521654333018e7 pam-devel-0.77-66.23.ia64.rpm
x86_64: f83fa911b83700f7767907e20d7c4d45 pam-0.77-66.23.i386.rpm 03ec1abab5c5ab9395d59b70c7f4ec36 pam-0.77-66.23.x86_64.rpm e9c41fa27b60845f56e15d63ac1335d0 pam-debuginfo-0.77-66.23.i386.rpm 0a8738a21ed748b168cc9f55a61ab423 pam-debuginfo-0.77-66.23.x86_64.rpm 7568bb0d75d41951a3956e1128787e78 pam-devel-0.77-66.23.i386.rpm 1e5df76e71f24d346b4bd55e00cdaf0c pam-devel-0.77-66.23.x86_64.rpm
These packages are GPG signed by Red Hat for security. Our key and details on how to verify the signature are available from https://www.redhat.com/security/team/key/#package
7. References:
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-1716 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-3102 http://www.redhat.com/security/updates/classification/#moderate
8. Contact:
The Red Hat security contact is <secalert@redhat.com>. More contact details at https://www.redhat.com/security/team/contact/
Copyright 2007 Red Hat, Inc. -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.4 (GNU/Linux)
iD8DBQFHPF/9XlSAg2UNWIIRAp2LAJ9OzqPN5lZxZhET8rNjtFouY7NMhgCeNhfI 1dWo2BA6LfeDCtRzF0ip8/M= =PAKR -----END PGP SIGNATURE-----
-- Enterprise-watch-list mailing list Enterprise-watch-list@redhat.com https://www.redhat.com/mailman/listinfo/enterprise-watch-list
|