pam security update

CentOS Errata and Security Advisory CESA-2010:0819 Updated pam packages that fix three security issues are now available for Red Hat Enterprise Linux 5. The Red Hat Security Response Team has rated this update as having moderate security impact. Common Vulnerability Scoring System CVSS base score...

pam: pam_xauth missing return value checks from setuid() and similar calls

The runcoprocess function in pamxauth.c in the pamxauth module in Linux-PAM aka pam before 1.1.2 does not check the return values of the setuid, setgid, and setgroups system calls, which might allow local users to read arbitrary files by executing a program that relies on the pamxauth PAM check...

pam: pam_namespace executes namespace.init with service's environment

pamnamespace.c in the pamnamespace module in Linux-PAM aka pam before 1.1.3 uses the environment of the invoking application or service during execution of the namespace.init script, which might allow local users to gain privileges by running a setuid program that relies on the pamnamespace PAM...

pam: pam_xauth: Does not check if certain ACL file is a regular file

The checkacl function in pamxauth.c in the pamxauth module in Linux-PAM aka pam 1.1.2 and earlier does not verify that a certain ACL file is a regular file, which might allow local users to cause a denial of service resource consumption via a special file...

PT-2010-1043

Name of the Vulnerable Software and Affected Versions pam versions prior to 1.1.3 Red Hat Enterprise Linux affected versions not specified Description The issue concerns multiple vulnerabilities in the pam package of Red Hat Enterprise Linux. These vulnerabilities can be exploited locally,...

pam security update

0.99.6.2-6.2 - fix insecure dropping of priviledges in pamxauth and pammail - CVE-2010-3316 637898, CVE-2010-3435 641335 - fix insecure executing of scripts with user supplied environment variables in pamnamespace - CVE-2010-3853 643043...

PT-2010-1042 · Linux +1 · Linux-Pam +1

Name of the Vulnerable Software and Affected Versions: Linux-PAM versions prior to 1.1.2 Red Hat Enterprise Linux pam-devel version 1.1.1 Red Hat Enterprise Linux pam-debuginfo version 1.1.1 Red Hat Enterprise Linux pam version 1.1.1 Description: The issue concerns multiple vulnerabilities in the...

PT-2010-1044

Name of the Vulnerable Software and Affected Versions Linux-PAM versions 1.1.2 and earlier pam-devel-1.1.1 pam-debuginfo-1.1.1 pam-1.1.1 Description The issue is related to the pam xauth module in Linux-PAM, specifically the check acl function, which does not verify that a certain ACL file is a...

Ubuntu 10.10 : pam vulnerability (USN-959-2)

USN-959-1 fixed vulnerabilities in PAM. This update provides the corresponding updates for Ubuntu 10.10. Denis Excoffier discovered that the PAM MOTD module in Ubuntu did not correctly handle path permissions when creating user file stamps. A local attacker could exploit this to gain root...

USN-959-2: PAM vulnerability

USN-959-1 fixed vulnerabilities in PAM. This update provides the corresponding updates for Ubuntu 10.10. Original advisory details: Denis Excoffier discovered that the PAM MOTD module in Ubuntu did not correctly handle path permissions when creating user file stamps. A local attacker could exploi...

Fedora 13 : quagga-0.99.17-1.fc13 (2010-14009)

Tue Aug 31 2010 Jiri Skala - 0.99.17-1 - update to latest upstream - fixes 628981 - CVE-2010-2948 and CVE-2010-2949 - Fri Jun 11 2010 Jiri Skala - 0.99.15-3 - fixes 602851 - ships PAM config file, even though PAM is disabled - Tue Jan 26 2010 Jiri Skala - 0.99.15-2 - changes in spec file and init...

Fedora Update for sssd FEDORA-2010-13549

Check for the Version of sssd OpenVAS Vulnerability Test Fedora Update for sssd FEDORA-2010-13549 Authors: System Generated Check Copyright: Copyright c 2010 Greenbone Networks GmbH, http://www.greenbone.net This program is free software; you can redistribute it and/or modify it under the terms o...

[SECURITY] Fedora 14 Update: sssd-1.3.0-30.fc14

Provides a set of daemons to manage access to remote directories and authentication mechanisms. It provides an NSS and PAM interface toward the system and a pluggable backend system to connect to multiple different account sources. It is also the basis to provide client auditing and policy servic...

DEBIAN-CVE-2010-2940

The authsend function in providers/ldap/ldapauth.c in System Security Services Daemon SSSD 1.3.0, when LDAP authentication and anonymous bind are enabled, allows remote attackers to bypass the authentication requirements of pamauthenticate via an empty password...

Ubuntu PAM MOTD Local Root

!/bin/bash Exploit Title: Ubuntu PAM MOTD local root Date: July 9, 2010 Author: Anonymous Software Link: http://packages.ubuntu.com/ Version: pam-1.1.0 Tested on: Ubuntu 9.10 Karmic Koala, Ubuntu 10.04 LTS Lucid Lynx CVE: CVE-2010-0832 Patch Instructions: sudo aptitude -y update; sudo aptitude -y...

Design/Logic Flaw

pammotd aka the MOTD module in libpam-modules before 1.1.0-2ubuntu1.1 in PAM on Ubuntu 9.10 and libpam-modules before 1.1.1-2ubuntu5 in PAM on Ubuntu 10.04 LTS allows local users to change the ownership of arbitrary files via a symlink attack on .cache in a user's home directory, related to "user...

Linux PAM 1.1.0 (Ubuntu 9.10/10.04) - MOTD File Tampering Privilege Escalation (2)

!/bin/bash Exploit Title: Ubuntu PAM MOTD local root Date: July 9, 2010 Author: Anonymous Software Link: http://packages.ubuntu.com/ Version: pam-1.1.0 Tested on: Ubuntu 9.10 Karmic Koala, Ubuntu 10.04 LTS Lucid Lynx CVE: CVE-2010-0832 Patch Instructions: sudo aptitude -y update; sudo aptitude -y...

Linux PAM 1.1.0 (Ubuntu 9.1010.04) - MOTD File Tampering Privilege Escalation (2)

Linux PAM 1.1.0 Ubuntu 9.1010.04 - MOTD File Tampering Privilege Escalation 2 !/bin/bash Exploit Title: Ubuntu PAM MOTD local root Date: July 9, 2010 Author: Anonymous Software Link: http://packages.ubuntu.com/ Version: pam-1.1.0 Tested on: Ubuntu 9.10 Karmic Koala, Ubuntu 10.04 LTS Lucid Lynx CV...

Ubuntu PAM MOTD Local Root Exploit

Exploit for linux platform in category local exploits ================================== Ubuntu PAM MOTD Local Root Exploit ================================== !/bin/bash Exploit Title: Ubuntu PAM MOTD local root Date: July 9, 2010 Author: Anonymous Software Link: http://packages.ubuntu.com/...

Ubuntu: Security Advisory (USN-959-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2010 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...