Gentoo Archives: gentoo-announce

From: Stefan Behte <craig@g.o>
To: gentoo-announce@g.o
Subject: [gentoo-announce] [ GLSA 201206-31 ] Linux-PAM: Multiple vulnerabilities
Date: Mon, 25 Jun 2012 19:25:23
Message-Id: 4FE8B612.4030803@gentoo.org
1 - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
2 Gentoo Linux Security Advisory GLSA 201206-31
3 - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
4 http://security.gentoo.org/
5 - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
6
7 Severity: High
8 Title: Linux-PAM: Multiple vulnerabilities
9 Date: June 25, 2012
10 Bugs: #343399, #386273, #388431
11 ID: 201206-31
12
13 - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
14
15 Synopsis
16 ========
17
18 Multiple vulnerabilities have been found in Linux-PAM, allowing local
19 attackers to possibly gain escalated privileges, cause a Denial of
20 Service, corrupt data, or obtain sensitive information.
21
22 Background
23 ==========
24
25 Linux-PAM (Pluggable Authentication Modules) is an architecture
26 allowing the separation of the development of privilege granting
27 software from the development of secure and appropriate authentication
28 schemes.
29
30 Affected packages
31 =================
32
33 -------------------------------------------------------------------
34 Package / Vulnerable / Unaffected
35 -------------------------------------------------------------------
36 1 sys-libs/pam < 1.1.5 >= 1.1.5
37
38 Description
39 ===========
40
41 Multiple vulnerabilities have been discovered in Linux-PAM. Please
42 review the CVE identifiers referenced below for details.
43
44 Impact
45 ======
46
47 A local attacker could use specially crafted files to cause a buffer
48 overflow, possibly resulting in privilege escalation or Denial of
49 Service. Furthermore, a local attacker could execute specially crafted
50 programs or symlink attacks, possibly resulting in data loss or
51 disclosure of sensitive information.
52
53 Workaround
54 ==========
55
56 There is no known workaround at this time.
57
58 Resolution
59 ==========
60
61 All Linux-PAM users should upgrade to the latest version:
62
63 # emerge --sync
64 # emerge --ask --oneshot --verbose ">=sys-libs/pam-1.1.5"
65
66 NOTE: This is a legacy GLSA. Updates for all affected architectures are
67 available since November 25, 2011. It is likely that your system is
68 already no longer affected by this issue.
69
70 References
71 ==========
72
73 [ 1 ] CVE-2010-3316
74 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2010-3316
75 [ 2 ] CVE-2010-3430
76 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2010-3430
77 [ 3 ] CVE-2010-3431
78 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2010-3431
79 [ 4 ] CVE-2010-3435
80 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2010-3435
81 [ 5 ] CVE-2010-3853
82 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2010-3853
83 [ 6 ] CVE-2010-4706
84 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2010-4706
85 [ 7 ] CVE-2010-4707
86 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2010-4707
87 [ 8 ] CVE-2010-4708
88 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2010-4708
89 [ 9 ] CVE-2011-3148
90 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2011-3148
91 [ 10 ] CVE-2011-3149
92 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2011-3149
93
94 Availability
95 ============
96
97 This GLSA and any updates to it are available for viewing at
98 the Gentoo Security Website:
99
100 http://security.gentoo.org/glsa/glsa-201206-31.xml
101
102 Concerns?
103 =========
104
105 Security is a primary focus of Gentoo Linux and ensuring the
106 confidentiality and security of our users' machines is of utmost
107 importance to us. Any security concerns should be addressed to
108 security@g.o or alternatively, you may file a bug at
109 https://bugs.gentoo.org.
110
111 License
112 =======
113
114 Copyright 2012 Gentoo Foundation, Inc; referenced text
115 belongs to its owner(s).
116
117 The contents of this document are licensed under the
118 Creative Commons - Attribution / Share Alike license.
119
120 http://creativecommons.org/licenses/by-sa/2.5

Attachments

File name MIME type
signature.asc application/pgp-signature