Mandrake Linux Security Advisory : util-linux (MDKSA-2001:084)

High Nessus Plugin ID 13897


The remote Mandrake Linux host is missing a security update.


Tarhon-Onu Victor found a problem in /bin/login's PAM implementation.
It stored the value of a static pwent buffer across PAM calls, and when used with some PAM modules in non-default configurations (ie.
using pam_limits), it would overwrite the buffer and cause the user to get the credentials of another user. Thanks to Olaf Kirch for providing the patch to fix the problem.


Update the affected util-linux package.

Plugin Details

Severity: High

ID: 13897

File Name: mandrake_MDKSA-2001-084.nasl

Version: $Revision: 1.13 $

Type: local

Published: 2004/07/31

Modified: 2013/05/31

Dependencies: 12634

Risk Information

Risk Factor: High


Base Score: 7.2

Vector: CVSS2#AV:L/AC:L/Au:N/C:C/I:C/A:C

Vulnerability Information

CPE: p-cpe:/a:mandriva:linux:util-linux, cpe:/o:mandrakesoft:mandrake_linux:8.0, cpe:/o:mandrakesoft:mandrake_linux:8.1

Required KB Items: Host/local_checks_enabled, Host/cpu, Host/Mandrake/release, Host/Mandrake/rpm-list

Patch Publication Date: 2001/11/01

Reference Information

CVE: CVE-2001-1147

MDKSA: 2001:084