Home > Security > Advisories

Advisories

Mandriva Advisories

Package name util-linux
Date June 4th, 2007
Advisory ID MDKSA-2007:111
Affected versions CS3.0, MNF2.0, 2007.0, CS4.0, 2007.1
Synopsis Updated util-linux packages address login access policies bypassing issue

Problem Description

login in util-linux-2.12a (and later versions) skips pam_acct_mgmt
and chauth_tok when authentication is skipped, such as when a
Kerberos krlogin session has been established, which might allow
users to bypass intended access policies that would be enforced by
pam_acct_mgmt and chauth_tok.

Updated packages have been patched to address this issue.

Updated Packages

Corporate Server 3.0

 aeea368d87973112f486157eb8e7a392  corporate/3.0/i586/losetup-2.12-2.2.C30mdk.i586.rpm
 5368318cb1d78cfe55ab380fbb892e35  corporate/3.0/i586/mount-2.12-2.2.C30mdk.i586.rpm
 9823ba9ec1c0aa6cdcd8400adfae4067  corporate/3.0/i586/util-linux-2.12-2.2.C30mdk.i586.rpm 
 61dce5786fb8fcf8d47866a2f5ccac73  corporate/3.0/SRPMS/util-linux-2.12-2.2.C30mdk.src.rpm

Corporate Server 3.0/X86_64

 303222d2782ec741d3eec97393d24934  corporate/3.0/x86_64/losetup-2.12-2.2.C30mdk.x86_64.rpm
 92952fcf2df3456c4c45378cd5c9d35d  corporate/3.0/x86_64/mount-2.12-2.2.C30mdk.x86_64.rpm
 394783ba574f715de60eb916656d08bf  corporate/3.0/x86_64/util-linux-2.12-2.2.C30mdk.x86_64.rpm 
 61dce5786fb8fcf8d47866a2f5ccac73  corporate/3.0/SRPMS/util-linux-2.12-2.2.C30mdk.src.rpm

Multi Network Firewall 2.0

 6c6ee8df170f2045a0be93cf8941280b  mnf/2.0/i586/losetup-2.12-2.2.M20mdk.i586.rpm
 cf8a60bb88115e6f4d3076b5a1df50e5  mnf/2.0/i586/mount-2.12-2.2.M20mdk.i586.rpm
 298e9d5915b752d32c8824c986ba8276  mnf/2.0/i586/util-linux-2.12-2.2.M20mdk.i586.rpm 
 d81106fb4614aab0ce85aac38b5c8231  mnf/2.0/SRPMS/util-linux-2.12-2.2.M20mdk.src.rpm

Mandriva Linux 2007

 c6ccfda3e51f799be58d347a6252fc0d  2007.0/i586/losetup-2.12r-8.2mdv2007.0.i586.rpm
 00677b03b96e27a2e04b1614cd717821  2007.0/i586/mount-2.12r-8.2mdv2007.0.i586.rpm
 be40a7e5880fc2f2734aced382b973bf  2007.0/i586/util-linux-2.12r-8.2mdv2007.0.i586.rpm 
 a191a26c8a8bf8e09f9c2ed0f1355f45  2007.0/SRPMS/util-linux-2.12r-8.2mdv2007.0.src.rpm

Mandriva Linux 2007/X86_64

 3af6dbd097cd5f76876aaab20d0a460c  2007.0/x86_64/losetup-2.12r-8.2mdv2007.0.x86_64.rpm
 944ba5000fbe19ff0aec7f7cb5e95f3b  2007.0/x86_64/mount-2.12r-8.2mdv2007.0.x86_64.rpm
 8a9f34e7452785cb1b99428f4aa3e1c6  2007.0/x86_64/util-linux-2.12r-8.2mdv2007.0.x86_64.rpm 
 a191a26c8a8bf8e09f9c2ed0f1355f45  2007.0/SRPMS/util-linux-2.12r-8.2mdv2007.0.src.rpm

Corporate Server 4.0

 ef4ae1050f3db1223833665beaabc8b0  corporate/4.0/i586/losetup-2.12q-7.2.20060mlcs4.i586.rpm
 a8d6eab630efed0f6fc762f187868698  corporate/4.0/i586/mount-2.12q-7.2.20060mlcs4.i586.rpm
 a8fc8381718430bd75de652b11f39ae1  corporate/4.0/i586/util-linux-2.12q-7.2.20060mlcs4.i586.rpm 
 8f216edaf80c4320b27b0e4e4f93b78a  corporate/4.0/SRPMS/util-linux-2.12q-7.2.20060mlcs4.src.rpm

Corporate Server 4.0/X86_64

 3aeec0f637c8e7ed452af857320c4eda  corporate/4.0/x86_64/losetup-2.12q-7.2.20060mlcs4.x86_64.rpm
 17dddbe7a339f5d0f97fc555fe945016  corporate/4.0/x86_64/mount-2.12q-7.2.20060mlcs4.x86_64.rpm
 44fb996e88d86b74403e6a79f3a247fb  corporate/4.0/x86_64/util-linux-2.12q-7.2.20060mlcs4.x86_64.rpm 
 8f216edaf80c4320b27b0e4e4f93b78a  corporate/4.0/SRPMS/util-linux-2.12q-7.2.20060mlcs4.src.rpm

Mandriva Linux 2007.1

 dac84f6fd34e6390bf8895f499ea14c9  2007.1/i586/losetup-2.12r-12.1mdv2007.1.i586.rpm
 6d8c238a5c8ab87221946cd2eea65b7e  2007.1/i586/mount-2.12r-12.1mdv2007.1.i586.rpm
 c590331e6d863b2da097a0ce84dc1e6e  2007.1/i586/util-linux-2.12r-12.1mdv2007.1.i586.rpm 
 ed6995fcf07fe3e8a45c7cf168ef4b9e  2007.1/SRPMS/util-linux-2.12r-12.1mdv2007.1.src.rpm

Mandriva Linux 2007.1/X86_64

 a5164c59195655944cfa8a0b091954e5  2007.1/x86_64/losetup-2.12r-12.1mdv2007.1.x86_64.rpm
 3b45cf9ba0a237f8102fe5b18fb287ea  2007.1/x86_64/mount-2.12r-12.1mdv2007.1.x86_64.rpm
 c7643e7ccd4d6d6db7a8ec5a64c0abc3  2007.1/x86_64/util-linux-2.12r-12.1mdv2007.1.x86_64.rpm 
 ed6995fcf07fe3e8a45c7cf168ef4b9e  2007.1/SRPMS/util-linux-2.12r-12.1mdv2007.1.src.rpm

References

http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-7108

Upgrade

To upgrade automatically, use MandrivaUpdate.


Verification

Please verify the update prior to upgrading to ensure the integrity of the downloaded package. You can do this with the command :

                rpm --checksig package.rpm

You can get the GPG public key of the Mandriva Security Team to verify the GPG signature of each RPM.

If you use MandrivaUpdate, the verification of md5 checksum and GPG signature is performed automatically for you.