Mandrake Linux Security Advisory : util-linux (MDKSA-2001:084)
High Nessus Plugin ID 13897
SynopsisThe remote Mandrake Linux host is missing a security update.
DescriptionTarhon-Onu Victor found a problem in /bin/login's PAM implementation.
It stored the value of a static pwent buffer across PAM calls, and when used with some PAM modules in non-default configurations (ie.
using pam_limits), it would overwrite the buffer and cause the user to get the credentials of another user. Thanks to Olaf Kirch for providing the patch to fix the problem.
SolutionUpdate the affected util-linux package.