Scientific Linux Security Update : conga on SL5.x i386/x86_64

A flaw was found in ricci during a code audit. A remote attacker who is able to connect to ricci could cause ricci to temporarily refuse additional connections, a denial of service CVE-2007-4136. Fixes in this updated package include : - The nodename is now set for manual fencing. - The node log ...

Scientific Linux Security Update : pam_krb5 on SL5.x i386/x86_64

A flaw was found in pamkrb5. In some non-default configurations specifically, those where pamkrb5 would be the first module to prompt for a password, the text of the password prompt varied based on whether or not the username provided was a username known to the system. A remote attacker could us...

Scientific Linux Security Update : pam on SL4.x i386/x86_64

A flaw was found in the way pamconsole set console device permissions. It was possible for various console devices to retain ownership of the console user after logging out, possibly leaking information to another local user. CVE-2007-1716 A flaw was found in the way the PAM library wrote account...

Scientific Linux Security Update : vsftpd on SL3.x i386/x86_64

The version of vsftpd as shipped in Scientific Linux 3 when used in combination with Pluggable Authentication Modules PAM had a memory leak on an invalid authentication attempt. Since vsftpd prior to version 2.0.5 allows any number of invalid attempts on the same connection this memory leak could...

Scientific Linux Security Update : wireshark on SL3.x, SL4.x, SL5.x i386/x86_64

Multiple buffer overflow flaws were found in Wireshark. If Wireshark read a malformed packet off a network, it could crash or, possibly, execute arbitrary code as the user running Wireshark. CVE-2008-3146 Several denial of service flaws were found in Wireshark. Wireshark could crash or stop...

Scientific Linux Security Update : pam on SL5.x i386/x86_64

It was discovered that the pamnamespace module executed the external script namespace.init with an unchanged environment inherited from an application calling PAM. In cases where such an environment was untrusted for example, when pamnamespace was configured for setuid applications such as su or...

Scientific Linux Security Update : coreutils on SL4.x i386/x86_64

The coreutils packages were found to not use the pamsucceedif Pluggable Authentication Module PAM correctly in the configuration file for the 'su' command. Any local user could use this command to change to a locked or expired user account if the target account's password was known to the user...

Scientific Linux Security Update : vsftpd on SL4.x i386/x86_64

The version of vsftpd as shipped in Red Hat Enterprise Linux 4 when used in combination with Pluggable Authentication Modules PAM had a memory leak on an invalid authentication attempt. Since vsftpd prior to version 2.0.5 allows any number of invalid attempts on the same connection this memory le...

Scientific Linux Security Update : sssd on SL5.x i386/x86_64

The System Security Services Daemon SSSD provides a set of daemons to manage access to remote directories and authentication mechanisms. It provides an NSS and PAM interface toward the system and a pluggable back-end system to connect to multiple different account sources. It is also the basis to...

Scientific Linux Security Update : pam_krb5 on SL3.x i386/x86_64

These updated pam-krb5 packages fix a bug which caused user authentication to fail under certain circumstances. When authenticating a user, if the user's password was expired, the module would attempt to obtain password-changing credentials in order to verify the user's password. When the module...

CentOS Update for sssd CESA-2011:0975 centos5 x86_64

Check for the Version of sssd OpenVAS Vulnerability Test CentOS Update for sssd CESA-2011:0975 centos5 x8664 Authors: System Generated Check Copyright: Copyright c 2012 Greenbone Networks GmbH, http://www.greenbone.net This program is free software; you can redistribute it and/or modify it under...

DEBIAN-CVE-2011-3149

The expandarg function in the pamenv module modules/pamenv/pamenv.c in Linux-PAM aka pam before 1.1.5 does not properly handle when environment variable expansion can overflow, which allows local users to cause a denial of service CPU consumption...

CVE-2011-3148

Stack-based buffer overflow in the assembleline function in modules/pamenv/pamenv.c in Linux-PAM aka pam before 1.1.5 allows local users to cause a denial of service crash and possibly execute arbitrary code via a long string of white spaces at the beginning of the /.pamenvironment file...

CVE-2011-3149

The expandarg function in the pamenv module modules/pamenv/pamenv.c in Linux-PAM aka pam before 1.1.5 does not properly handle when environment variable expansion can overflow, which allows local users to cause a denial of service CPU consumption...

CVE-2011-3148

Stack-based buffer overflow in the assembleline function in modules/pamenv/pamenv.c in Linux-PAM aka pam before 1.1.5 allows local users to cause a denial of service crash and possibly execute arbitrary code via a long string of white spaces at the beginning of the /.pamenvironment file...

CVE-2011-3149

The expandarg function in the pamenv module modules/pamenv/pamenv.c in Linux-PAM aka pam before 1.1.5 does not properly handle when environment variable expansion can overflow, which allows local users to cause a denial of service CPU consumption...

Design/Logic Flaw

The expandarg function in the pamenv module modules/pamenv/pamenv.c in Linux-PAM aka pam before 1.1.5 does not properly handle when environment variable expansion can overflow, which allows local users to cause a denial of service CPU consumption...

Stack overflow

Stack-based buffer overflow in the assembleline function in modules/pamenv/pamenv.c in Linux-PAM aka pam before 1.1.5 allows local users to cause a denial of service crash and possibly execute arbitrary code via a long string of white spaces at the beginning of the /.pamenvironment file...

CVE-2011-3148

CVE-2011-3148 affects Linux-PAM (pam_env) before 1.1.5. The stack-based buffer overflow occurs in the _assemble_line function when parsing a long string of spaces at the beginning of ~/.pam_environment, enabling local users to crash the PAM process and potentially execute arbitrary code. Connecte...

CVE-2011-3149

The expandarg function in the pamenv module modules/pamenv/pamenv.c in Linux-PAM aka pam before 1.1.5 does not properly handle when environment variable expansion can overflow, which allows local users to cause a denial of service CPU consumption...