RHEA-2012:0328 - Product Enhancement Advisory

Topic

An updated passwd package that adds two enhancements is now available for Red
Hat Enterprise Linux 6.

Description

The passwd packages contain a system utility, "passwd", which changes passwords
and displays password status information using the Pluggable Authentication
Modules (PAM) and Libuser libraries.

This update adds the following enhancements:

• The passwd command now supports a new option, "-e", that allows the system

administrator to expire the password of the specified user so that the user is
forced to change the password on the next login attempt. (BZ#791139)

• The passwd executable file is a setuid program so it needs to be well

protected against various types of attacks. With this update, passwd has been
built with the Position Independent Executables (PIE) flag, "-fPIE -pie", and
the full read-only relocations (RELRO) flags, "-Wl,-z,relro,-z,now". The passwd
binary is now well protected against "return-to-text" and memory corruption
attacks and also against attacks based on the program's ELF section overwriting.
(BZ#791143)

All users of passwd are advised to upgrade to this updated package, which adds
these enhancements.

Solution

Before applying this update, make sure all previously-released errata relevant
to your system have been applied.

This update is available via the Red Hat Network. Details on how to use the Red
Hat Network to apply this update are available at
http://kbase.redhat.com/faq/docs/DOC-11259

Affected Products

• Red Hat Enterprise Linux Server 6 x86_64
• Red Hat Enterprise Linux Server 6 i386
• Red Hat Enterprise Linux for x86_64 - Extended Update Support 6.2 x86_64
• Red Hat Enterprise Linux for x86_64 - Extended Update Support 6.2 i386
• Red Hat Enterprise Linux Server - Extended Life Cycle Support 6 i386
• Red Hat Enterprise Linux Workstation 6 x86_64
• Red Hat Enterprise Linux Workstation 6 i386
• Red Hat Enterprise Linux Desktop 6 x86_64
• Red Hat Enterprise Linux Desktop 6 i386
• Red Hat Enterprise Linux for IBM z Systems 6 s390x
• Red Hat Enterprise Linux for IBM z Systems - Extended Update Support 6.2 s390x
• Red Hat Enterprise Linux for Power, big endian 6 ppc64
• Red Hat Enterprise Linux for Power, big endian - Extended Update Support 6.2 ppc64
• Red Hat Enterprise Linux for Scientific Computing 6 x86_64
• Red Hat Enterprise Linux Server from RHUI 6 x86_64
• Red Hat Enterprise Linux Server from RHUI 6 i386
• Red Hat Enterprise Linux Server - Extended Update Support from RHUI 6.2 x86_64
• Red Hat Enterprise Linux Server - Extended Update Support from RHUI 6.2 i386
• Red Hat Storage 2.0 x86_64
• Red Hat Gluster Storage Server for On-premise 2.0 x86_64
• Red Hat Storage for Public Cloud (via RHUI) 2.0 x86_64
• Red Hat Enterprise Linux Server - AUS 6.2 x86_64
• Red Hat Enterprise Linux Server - Extended Life Cycle Support 6 x86_64
• Red Hat Enterprise Linux Server - Extended Life Cycle Support (for IBM z Systems) 6 s390x

Fixes

• BZ - 791143 - passwd should be compiled with PIE and RELRO flags

CVEs

(none)

References

(none)