RHBA-2007:0832 - Bug Fix Advisory

Topic

Updated shadow-utils packages that fix various bugs are now
available.

Description

The shadow-utils package includes the necessary programs for converting
UNIX password files to the shadow password format, plus programs for
managing user and group accounts.

These updated packages fix the following issues:

• in previous shadow-utils packages /var/log/faillog was created as a huge,

sparse file. Utilities trying to read this file could cause a system hang.

• userdel and usermod caused infinite loops when duplicate names existed in

/etc/group or /etc/shadow. These infinite loops leaked memory and could
eventually crash the machine with out-of-memory errors.

• if the shadow password suite configuration file -- /etc/login.defs -- was

modified, shadow-utils version 4.0.3-61 would not install unless forced
using the "update -f" command. Using this option, however, would cause the
extant /etc/login.defs file to be renamed to /etc/login.defs.rpmsave,
leaving a default login.defs file in its place. The update package's spec
file now marks /etc/login.defs to not be replaced during updates.

All shadow-utils users should upgrade to these updated packages, which
resolve these issues.

Solution

Before applying this update, make sure that all previously-released
errata relevant to your system have been applied.

This update is available via Red Hat Network. Details on how to use
the Red Hat Network to apply this update are available at
http://kbase.redhat.com/faq/FAQ_58_10188

Affected Products

• Red Hat Enterprise Linux Server 4 x86_64
• Red Hat Enterprise Linux Server 4 ia64
• Red Hat Enterprise Linux Server 4 i386
• Red Hat Enterprise Linux Workstation 4 x86_64
• Red Hat Enterprise Linux Workstation 4 ia64
• Red Hat Enterprise Linux Workstation 4 i386
• Red Hat Enterprise Linux Desktop 4 x86_64
• Red Hat Enterprise Linux Desktop 4 i386
• Red Hat Enterprise Linux for IBM z Systems 4 s390x
• Red Hat Enterprise Linux for IBM z Systems 4 s390
• Red Hat Enterprise Linux for Power, big endian 4 ppc

Fixes

• BZ - 239018 - /etc/login.defs overwrites customer config
• BZ - 240915 - [RHEL4] userdel/usermod infinite loop with duplicate names in /etc/group or /etc/gshadow

CVEs

(none)

References

(none)