RHSA-2007:0465 - Security Advisory

Topic

Updated pam packages that resolves several bugs and security flaws are now
available for Red Hat Enterprise Linux 3.

This update has been rated as having moderate security impact by the Red
Hat Security Response Team.

Description

Pluggable Authentication Modules (PAM) provide a system whereby
administrators can set up authentication policies without having to
recompile programs that handle authentication.

A flaw was found in the way the Linux kernel handled certain SG_IO
commands. Console users with access to certain device files had the ability
to damage recordable CD drives. The way pam_console handled permissions of
these files has been modified to disallow access. This change also required
modifications to the cdrecord application. (CVE-2004-0813)

A flaw was found in the way pam_console set console device permissions. It
was possible for various console devices to retain ownership of the console
user after logging out, possibly leaking information to an unauthorized
user. (CVE-2007-1716)

The pam_unix module provides authentication against standard /etc/passwd
and /etc/shadow files. The pam_stack module provides support for stacking
PAM configuration files. Both of these modules contained small memory leaks
which caused problems in applications calling PAM authentication repeatedly
in the same process.

All users of PAM should upgrade to these updated packages, which resolve
these issues.

Solution

Before applying this update, make sure all previously released errata
relevant to your system have been applied.

To update all RPMs for your particular architecture, run:

rpm -Fvh [filenames]

where [filenames] is a list of the RPMs you wish to upgrade. Only those
RPMs which are currently installed will be updated. Those RPMs which are
not installed but included in the list will not be updated. Note that you
can also use wildcards (*.rpm) if your current directory *only* contains the
desired RPMs.

Please note that this update is also available via Red Hat Network. Many
people find this an easier way to apply updates. To use Red Hat Network,
launch the Red Hat Update Agent with the following command:

up2date

This will start an interactive process that will result in the appropriate
RPMs being upgraded on your system.

If up2date fails to connect to Red Hat Network due to SSL
Certificate Errors, you need to install a version of the
up2date client with an updated certificate. The latest version of
up2date is available from the Red Hat FTP site and may also be
downloaded directly from the RHN website:

https://rhn.redhat.com/help/latest-up2date.pxt

Affected Products

• Red Hat Enterprise Linux Server 3 x86_64
• Red Hat Enterprise Linux Server 3 ia64
• Red Hat Enterprise Linux Server 3 i386
• Red Hat Enterprise Linux Workstation 3 x86_64
• Red Hat Enterprise Linux Workstation 3 ia64
• Red Hat Enterprise Linux Workstation 3 i386
• Red Hat Enterprise Linux Desktop 3 x86_64
• Red Hat Enterprise Linux Desktop 3 i386
• Red Hat Enterprise Linux for IBM z Systems 3 s390x
• Red Hat Enterprise Linux for IBM z Systems 3 s390
• Red Hat Enterprise Linux for Power, big endian 3 ppc

Fixes

• BZ - 133098 - CVE-2004-0813 SG_IO unsafe user command execution
• BZ - 204055 - Possibly memory leak in pam modules.
• BZ - 230625 - 4byte leak in pam_unix.so
• BZ - 232096 - CVE-2004-0813 SG_IO unsafe user command execution
• BZ - 234142 - CVE-2007-1716 Ownership of devices not returned to root after logout from console

CVEs

• CVE-2004-0813
• CVE-2007-1716

References

• http://www.redhat.com/security/updates/classification/#moderate