Argument injection vulnerability in login (login-utils/login.c) in util-linux-ng 2.14 and earlier makes it easier for remote attackers to hide activities by modifying portions of log events, as demonstrated by appending an "addr=" statement to the login name, aka "audit log injection."

An updated util-linux package that fixes one security issue and several bugs is now available.

This update has been rated as having low security impact by the Red Hat Security Response Team.

The util-linux package contains a collection of basic system utilities, such as fdisk and mount.

A log injection attack was found in util-linux when logging log in attempts via the audit subsystem of the Linux kernel. A remote attacker could use this flaw to modify certain parts of logged events, possibly hiding their activities on a system. (CVE-2008-1926)

This updated package also fixes the following bugs :

* partitions created by VMware ESX(tm) were not included in the list of recognized file systems used by fdisk. Consequently, if VMware ESX was installed, 'fdisk -l' returned 'Unknown' for these partitions. With this update, information regarding the VMKcore and VMFS partitions has been added to the file systems list. On systems running VMware ESX, 'fdisk -l' now lists information about these partitions as expected.
(BZ#447264)

* if a username was not set, the login command would fail with a Segmentation fault. With this update, login lets the audit system handle NULL usernames (it sends an AUDIT_USER_LOGIN message to the audit system in the event there is no username set). (BZ#456213)

* the nfs(5) man page listed version 2 as the default. This is incorrect: unless otherwise specified, the NFS client uses NFS version 3. The man page has been corrected. (BZ#458539)

* in certain situations, backgrounded NFS mounts died shortly after being backgrounded when the mount command was executed by the initlog command, which, for example, would occur when running an init script, such as running the 'service netfs start' command. In these situations, running the 'ps -ef' command showed backgrounded NFS mounts disappearing shortly after being backgrounded. In this updated package, backgrounded mount processes detach from the controlling terminal, which resolves this issue. (BZ#461488)

* if a new partition's starting cylinder was beyond one terabyte, fdisk could not create the partition. This has been fixed. (BZ#471372)

* in rare cases 'mount -a' ignored fstab order and tried to re-mount file systems on mpath devices. With this update, mount honors fstab order even in the rare cases reported. (BZ#472186)

* the 'mount --move' command moved a file system's mount point as expected (for example, /proc/mounts showed the changed mount point as expected) but did not update /etc/mtab properly. With this update, the 'mount --move' command gathers all necessary information about the old mount point, copies it to the new mount point and then deletes the old point, ensuring /etc/mtab is updated properly. (BZ#485004)

Util-linux users are advised to upgrade to this updated package, which addresses this vulnerability and resolves these issues.

Argument injection vulnerability in login (login-utils/login.c) in util-linux-ng 2.14 and earlier makes it easier for remote attackers to hide activities by modifying portions of log events.

The updated packages have been patched to fix the issue.

- Tue Apr 22 2008 Karel Zak <kzak at redhat.com> 2.13.1-2

    - fix audit log injection attack via login

    - Wed Jan 16 2008 Karel Zak <kzak at redhat.com>       2.13.1-1

    - upgrade to stable util-linux-ng 2.13.1

    - fix #427874 - util-linux-ng gets 'excess command line       argument' on update

    - Thu Jan 3 2008 Karel Zak <kzak at redhat.com> 2.13-3.2

    - fix #427207 - util-linux-ng-2.13-3.1.fc8.src.rpm not       rebuilded

    - Wed Dec 5 2007 Karel Zak <kzak at redhat.com> 2.13-3.1

    - fix #409551 - hwclock: check for ENODEV (upstream       patch)

    - fix #408391 - setarch: add missing alpha subarchs       (upstream patch)

    - mkswap: possible to crash with SELinux relabeling       support (upstream patch)

    - mount: don't call canonicalize(SPEC) for cifs, smbfs       and nfs (upstream patch)

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	Name	Product	Family	Severity
67065	CentOS 4 : util-linux (CESA-2009:0981)	Nessus	CentOS Local Security Checks	high
38817	RHEL 4 : util-linux (RHSA-2009:0981)	Nessus	Red Hat Local Security Checks	high
36569	Mandriva Linux Security Advisory : util-linux-ng (MDVSA-2008:114)	Nessus	Mandriva Local Security Checks	high
32108	Fedora 8 : util-linux-ng-2.13.1-2.fc8 (2008-3419)	Nessus	Fedora Local Security Checks	high

Detections

Analytics

CVE-2008-1926

critical

Tenable Plugins

high

high

high

high