Synopsis

Low: coreutils security update

Type/Severity

Security Advisory: Low

Topic

Updated coreutils packages that fix a security issue are now available for
Red Hat Enterprise Linux 4.

This update has been rated as having low security impact by the Red Hat
Security Response Team.

Description

The coreutils package contains the core GNU utilities. It is the
combination of the old GNU fileutils, sh-utils, and textutils packages.

The coreutils packages were found to not use the pam_succeed_if Pluggable
Authentication Module (PAM) correctly in the configuration file for the
"su" command. Any local user could use this command to change to a locked
or expired user account if the target account's password was known to the
user running "su". These updated packages, correctly, only allow the root
user to switch to locked or expired accounts using "su". (CVE-2008-1946)

All users of coreutils are advised to upgrade to this updated package,
which resolve this issue.

Solution

Before applying this update, make sure that all previously-released
errata relevant to your system have been applied.

This update is available via Red Hat Network. Details on how to use
the Red Hat Network to apply this update are available at
http://kbase.redhat.com/faq/FAQ_58_10188

Affected Products

• Red Hat Enterprise Linux Server 4 x86_64
• Red Hat Enterprise Linux Server 4 ia64
• Red Hat Enterprise Linux Server 4 i386
• Red Hat Enterprise Linux Workstation 4 x86_64
• Red Hat Enterprise Linux Workstation 4 ia64
• Red Hat Enterprise Linux Workstation 4 i386
• Red Hat Enterprise Linux Desktop 4 x86_64
• Red Hat Enterprise Linux Desktop 4 i386
• Red Hat Enterprise Linux for IBM z Systems 4 s390x
• Red Hat Enterprise Linux for IBM z Systems 4 s390
• Red Hat Enterprise Linux for Power, big endian 4 ppc

Fixes

• BZ - 446488 - CVE-2008-1946 /etc/pam.d/su is wrong in RHEL-4.6

CVEs

• CVE-2008-1946

References

• http://www.redhat.com/security/updates/classification/#low

Red Hat Enterprise Linux Server 4

SRPM
coreutils-5.2.1-31.8.el4.src.rpm	SHA-256: c32ddfd1870cba12953d0c2e5daf6a205206f03e04801bc3893588d928770607
x86_64
coreutils-5.2.1-31.8.el4.x86_64.rpm	SHA-256: af1d91cf594386ea1ec9a754a9dd1e87b5ece8564df76eff79a1b0aa96289ae4
coreutils-5.2.1-31.8.el4.x86_64.rpm	SHA-256: af1d91cf594386ea1ec9a754a9dd1e87b5ece8564df76eff79a1b0aa96289ae4
ia64
coreutils-5.2.1-31.8.el4.ia64.rpm	SHA-256: d6db8dcfc776bb4a205e083b49f3f7f68eb7368357a1b07aba8ca0b9a66d731a
coreutils-5.2.1-31.8.el4.ia64.rpm	SHA-256: d6db8dcfc776bb4a205e083b49f3f7f68eb7368357a1b07aba8ca0b9a66d731a
i386
coreutils-5.2.1-31.8.el4.i386.rpm	SHA-256: 16dcccea971ca3fe16b2d1d1cfd6df3457f20ec41e31a5a3137f59f86032a76e
coreutils-5.2.1-31.8.el4.i386.rpm	SHA-256: 16dcccea971ca3fe16b2d1d1cfd6df3457f20ec41e31a5a3137f59f86032a76e

Red Hat Enterprise Linux Workstation 4

SRPM
coreutils-5.2.1-31.8.el4.src.rpm	SHA-256: c32ddfd1870cba12953d0c2e5daf6a205206f03e04801bc3893588d928770607
x86_64
coreutils-5.2.1-31.8.el4.x86_64.rpm	SHA-256: af1d91cf594386ea1ec9a754a9dd1e87b5ece8564df76eff79a1b0aa96289ae4
ia64
coreutils-5.2.1-31.8.el4.ia64.rpm	SHA-256: d6db8dcfc776bb4a205e083b49f3f7f68eb7368357a1b07aba8ca0b9a66d731a
i386
coreutils-5.2.1-31.8.el4.i386.rpm	SHA-256: 16dcccea971ca3fe16b2d1d1cfd6df3457f20ec41e31a5a3137f59f86032a76e

Red Hat Enterprise Linux Desktop 4

SRPM
coreutils-5.2.1-31.8.el4.src.rpm	SHA-256: c32ddfd1870cba12953d0c2e5daf6a205206f03e04801bc3893588d928770607
x86_64
coreutils-5.2.1-31.8.el4.x86_64.rpm	SHA-256: af1d91cf594386ea1ec9a754a9dd1e87b5ece8564df76eff79a1b0aa96289ae4
i386
coreutils-5.2.1-31.8.el4.i386.rpm	SHA-256: 16dcccea971ca3fe16b2d1d1cfd6df3457f20ec41e31a5a3137f59f86032a76e

Red Hat Enterprise Linux for IBM z Systems 4

SRPM
coreutils-5.2.1-31.8.el4.src.rpm	SHA-256: c32ddfd1870cba12953d0c2e5daf6a205206f03e04801bc3893588d928770607
s390x
coreutils-5.2.1-31.8.el4.s390x.rpm	SHA-256: 76ac0639ff9592ae5d5594b923d8720a32ae8ca54c8842cc48b47f7229313b0f
s390
coreutils-5.2.1-31.8.el4.s390.rpm	SHA-256: bff0d4da1ba67558ed8447a1b482afa5e79a38fa3a55c0c587963fb795fc879f

Red Hat Enterprise Linux for Power, big endian 4

SRPM
coreutils-5.2.1-31.8.el4.src.rpm	SHA-256: c32ddfd1870cba12953d0c2e5daf6a205206f03e04801bc3893588d928770607
ppc
coreutils-5.2.1-31.8.el4.ppc.rpm	SHA-256: b6bec378e83ffbd721cc288392ad687095bdfaaca16a73a3f565d592e7654711