Mandrake Linux Security Advisory : util-linux (MDKSA-2001:084)

high Nessus Plugin ID 13897

Synopsis

The remote Mandrake Linux host is missing a security update.

Description

Tarhon-Onu Victor found a problem in /bin/login's PAM implementation.
It stored the value of a static pwent buffer across PAM calls, and when used with some PAM modules in non-default configurations (ie.
using pam_limits), it would overwrite the buffer and cause the user to get the credentials of another user. Thanks to Olaf Kirch for providing the patch to fix the problem.

Solution

Update the affected util-linux package.

Plugin Details

Severity: High

ID: 13897

File Name: mandrake_MDKSA-2001-084.nasl

Version: 1.16

Type: local

Family: Mandriva Local Security Checks

Published: 7/31/2004

Updated: 1/6/2021

Supported Sensors: Nessus

Risk Information

VPR

Risk Factor: Medium

Score: 5.9

CVSS v2

Risk Factor: High

Base Score: 7.2

Vector: CVSS2#AV:L/AC:L/Au:N/C:C/I:C/A:C

Vulnerability Information

CPE: p-cpe:/a:mandriva:linux:util-linux, cpe:/o:mandrakesoft:mandrake_linux:8.0, cpe:/o:mandrakesoft:mandrake_linux:8.1

Required KB Items: Host/local_checks_enabled, Host/cpu, Host/Mandrake/release, Host/Mandrake/rpm-list

Patch Publication Date: 11/1/2001

Reference Information

CVE: CVE-2001-1147

MDKSA: 2001:084

Detections

Analytics