RHBA-2015:0453 - Bug Fix Advisory

Topic

Updated pam packages that fix several bugs and add one enhancement are now
available for Red Hat Enterprise Linux 7.

Description

Pluggable Authentication Modules (PAM) provide a system to set up authentication
policies without the need to recompile programs to handle authentication.

This update fixes the following bugs:

• Previously, the pam_limits module did not verify whether the process that is

referenced in the utmp file as being the login process still existed.
Consequently, when the user had the maxlogins limit set in the limits.conf file
and if the login session process terminated unexpectedly and did not update the
utmp file properly, the user could be prevented from access to the system even
if some of his previous login session no longer existed due to the crash. With
this update, pam_limits tests whether the login process still exists on the
system, and the number of existing login sessions is counted more precisely when
maxlogin limit is applied by the pam_limits module, thus fixing the bug.
(BZ#1080023)

• Prior to this update, the pam_unix and pam_pwhistory modules did not properly

handle missing fields in the /etc/security/opasswd entries.
Consequently, when some of the fields were not present in the user's entry, the
password changing process could terminate unexpectedly with a segmentation fault
due to NULL dereference. With this update, pam_unix and pam_pwhistory properly
handle the missing fields, and the password changing process, such as passwd, no
longer crashes in the described scenario. (BZ#1120101)

• Previously, the pam_tally2 and pam_faillock utilities used the AUDIT_USER_ACCT

audit event type when manipulating the account lock count. As a consequence, the
audit records created by these utilities were incorrect. The pam_tally2 and
pam_faillock utilities now use the AUDIT_USER_MGMT audit event type in the
described situation, and the audit records created by these utilities are now
correct. (BZ#1151576)

In addition, this update adds the following enhancement:

• With this update, audit records generated by the PAM library include a field

indicating which PAM modules provided the successful PAM library call result.
This feature is particularly needed for common criteria validation of system
authentication using the local and remote authentication services. (BZ#1115189)

Users of pam are advised to upgrade to these updated packages, which fix these
bugs and add this enhancement.

Solution

Before applying this update, make sure all previously released errata
relevant to your system have been applied.

For details on how to apply this update, refer to:

https://access.redhat.com/articles/11258

Affected Products

• Red Hat Enterprise Linux Server 7 x86_64
• Red Hat Enterprise Linux for x86_64 - Extended Update Support 7.7 x86_64
• Red Hat Enterprise Linux for x86_64 - Extended Update Support 7.6 x86_64
• Red Hat Enterprise Linux for x86_64 - Extended Update Support 7.5 x86_64
• Red Hat Enterprise Linux for x86_64 - Extended Update Support 7.4 x86_64
• Red Hat Enterprise Linux for x86_64 - Extended Update Support 7.3 x86_64
• Red Hat Enterprise Linux Server - AUS 7.7 x86_64
• Red Hat Enterprise Linux Server - AUS 7.6 x86_64
• Red Hat Enterprise Linux Server - AUS 7.4 x86_64
• Red Hat Enterprise Linux Server - AUS 7.3 x86_64
• Red Hat Enterprise Linux Server - Extended Life Cycle Support 7 x86_64
• Red Hat Enterprise Linux Workstation 7 x86_64
• Red Hat Enterprise Linux Desktop 7 x86_64
• Red Hat Enterprise Linux for IBM z Systems 7 s390x
• Red Hat Enterprise Linux for IBM z Systems - Extended Update Support 7.7 s390x
• Red Hat Enterprise Linux for IBM z Systems - Extended Update Support 7.6 s390x
• Red Hat Enterprise Linux for IBM z Systems - Extended Update Support 7.5 s390x
• Red Hat Enterprise Linux for IBM z Systems - Extended Update Support 7.4 s390x
• Red Hat Enterprise Linux for IBM z Systems - Extended Update Support 7.3 s390x
• Red Hat Enterprise Linux for Power, big endian 7 ppc64
• Red Hat Enterprise Linux for Power, big endian - Extended Update Support 7.7 ppc64
• Red Hat Enterprise Linux for Power, big endian - Extended Update Support 7.6 ppc64
• Red Hat Enterprise Linux for Power, big endian - Extended Update Support 7.5 ppc64
• Red Hat Enterprise Linux for Power, big endian - Extended Update Support 7.4 ppc64
• Red Hat Enterprise Linux for Power, big endian - Extended Update Support 7.3 ppc64
• Red Hat Enterprise Linux for Scientific Computing 7 x86_64
• Red Hat Enterprise Linux Server from RHUI 7 x86_64
• Red Hat Enterprise Linux Server - TUS 7.7 x86_64
• Red Hat Enterprise Linux Server - TUS 7.6 x86_64
• Red Hat Enterprise Linux Server - TUS 7.3 x86_64
• Red Hat Enterprise Linux Server - Extended Life Cycle Support (for IBM z Systems) 7 s390x
• Red Hat Enterprise Linux EUS Compute Node 7.7 x86_64
• Red Hat Enterprise Linux EUS Compute Node 7.6 x86_64
• Red Hat Enterprise Linux EUS Compute Node 7.5 x86_64
• Red Hat Enterprise Linux EUS Compute Node 7.4 x86_64
• Red Hat Enterprise Linux EUS Compute Node 7.3 x86_64
• Red Hat Enterprise Linux for x86_64 - Update Services for SAP Solutions 7.7 x86_64
• Red Hat Enterprise Linux for x86_64 - Update Services for SAP Solutions 7.6 x86_64
• Red Hat Enterprise Linux for x86_64 - Update Services for SAP Solutions 7.4 x86_64
• Red Hat Enterprise Linux for x86_64 - Update Services for SAP Solutions 7.3 x86_64
• Red Hat Enterprise Linux Server - Extended Life Cycle Support for IBM Power, big endian 7 ppc64

Fixes

• BZ - 1078784 - fix pam_userdb man page example
• BZ - 1080023 - pam_limits does not always count the user logins correctly for testing maxlogins
• BZ - 1111220 - nofile comment in /etc/security/limits.conf refers to open files when it should refer to open file descriptors
• BZ - 1134421 - improve documentation of limits.conf
• BZ - 1139276 - when building mockroot $PATH may not be set for %post

CVEs

(none)

References

(none)