Updated pam packages that resolves several bugs and security flaws are now available for Red Hat Enterprise Linux 3.

This update has been rated as having moderate security impact by the Red Hat Security Response Team.

Pluggable Authentication Modules (PAM) provide a system whereby administrators can set up authentication policies without having to recompile programs that handle authentication.

A flaw was found in the way the Linux kernel handled certain SG_IO commands. Console users with access to certain device files had the ability to damage recordable CD drives. The way pam_console handled permissions of these files has been modified to disallow access. This change also required modifications to the cdrecord application.
(CVE-2004-0813)

A flaw was found in the way pam_console set console device permissions. It was possible for various console devices to retain ownership of the console user after logging out, possibly leaking information to an unauthorized user. (CVE-2007-1716)

The pam_unix module provides authentication against standard /etc/passwd and /etc/shadow files. The pam_stack module provides support for stacking PAM configuration files. Both of these modules contained small memory leaks which caused problems in applications calling PAM authentication repeatedly in the same process.

All users of PAM should upgrade to these updated packages, which resolve these issues.

Linux カーネルが特定の SG_IO コマンドを処理する方法で欠陥が見つかりました。特定のデバイスファイルにアクセスできるコンソールユーザーが記録可能な CD ドライブを破損させる可能性がありました。pam_console がこれらのファイルの権限を処理する方法が変更され、アクセスが拒否されるようになりました。この変更には、 cdrecord アプリケーションの変更も必要です。
（CVE-2004-0813）

pam_console が特定のコンソールデバイスの権限を設定する方法で欠陥が見つかりました。さまざまなコンソールデバイスが、ログアウト後にコンソールユーザーの所有権を保持し、承認されていないユーザーに情報を漏洩する可能性がありました。（CVE-2007-1716）

pam_unix モジュールは、標準の /etc/passwd ファイルおよび /etc/shadow ファイルに対する認証を提供します。pam_stack モジュールは、スタッキング PAM 構成ファイルのサポートを提供します。これらの両方のモジュールに小さなメモリリークがあり、そのためにアプリケーションが PAM 認証を同じプロセスで繰り返し呼び出す問題が発生していました。

Red Hat セキュリティアドバイザリ 2007:0465 から：

いくつかのバグとセキュリティの欠陥を解決する更新済みの pam パッケージが、Red Hat Enterprise Linux 3 で現在利用可能です。

Red Hat セキュリティレスポンスチームは、この更新は重要度中のセキュリティ影響があると評価しています。

Pluggable Authentication Modules（PAM）は、認証を処理するプログラムを再コンパイルせずに、管理者が認証ポリシーを設定できるシステムを提供します。

Linux カーネルが特定の SG_IO コマンドを処理する方法で欠陥が見つかりました。特定のデバイスファイルにアクセスできるコンソールユーザーが記録可能な CD ドライブを破損させる可能性がありました。pam_console がこれらのファイルの権限を処理する方法が変更され、アクセスが拒否されるようになりました。この変更には、 cdrecord アプリケーションの変更も必要です。
(CVE-2004-0813)

pam_console が特定のコンソールデバイスの権限を設定する方法で欠陥が見つかりました。さまざまなコンソールデバイスが、ログアウト後にコンソールユーザーの所有権を保持し、承認されていないユーザーに情報を漏洩する可能性がありました。(CVE-2007-1716)

pam_unix モジュールは、標準の /etc/passwd ファイルおよび /etc/shadow ファイルに対する認証を提供します。pam_stack モジュールは、スタッキング PAM 構成ファイルのサポートを提供します。これらの両方のモジュールに小さなメモリリークがあり、そのためにアプリケーションが PAM 認証を同じプロセスで繰り返し呼び出す問題が発生していました。

PAM の全ユーザーは、これらの更新済みパッケージへアップグレードし、これらの問題を解決する必要があります。

A flaw was found in the way the Linux kernel handled certain SG_IO commands. Console users with access to certain device files had the ability to damage recordable CD drives. The way pam_console handled permissions of these files has been modified to disallow access. This change also required modifications to the cdrecord application.
(CVE-2004-0813)

A flaw was found in the way pam_console set console device permissions. It was possible for various console devices to retain ownership of the console user after logging out, possibly leaking information to an unauthorized user. (CVE-2007-1716)

The pam_unix module provides authentication against standard /etc/passwd and /etc/shadow files. The pam_stack module provides support for stacking PAM configuration files. Both of these modules contained small memory leaks which caused problems in applications calling PAM authentication repeatedly in the same process.

From Red Hat Security Advisory 2007:0465 :

Updated pam packages that resolves several bugs and security flaws are now available for Red Hat Enterprise Linux 3.

This update has been rated as having moderate security impact by the Red Hat Security Response Team.

Pluggable Authentication Modules (PAM) provide a system whereby administrators can set up authentication policies without having to recompile programs that handle authentication.

A flaw was found in the way the Linux kernel handled certain SG_IO commands. Console users with access to certain device files had the ability to damage recordable CD drives. The way pam_console handled permissions of these files has been modified to disallow access. This change also required modifications to the cdrecord application.
(CVE-2004-0813)

A flaw was found in the way pam_console set console device permissions. It was possible for various console devices to retain ownership of the console user after logging out, possibly leaking information to an unauthorized user. (CVE-2007-1716)

The pam_unix module provides authentication against standard /etc/passwd and /etc/shadow files. The pam_stack module provides support for stacking PAM configuration files. Both of these modules contained small memory leaks which caused problems in applications calling PAM authentication repeatedly in the same process.

All users of PAM should upgrade to these updated packages, which resolve these issues.

在 Linux 核心處理某些 SG_IO 命令的方式中發現一個瑕疵。能夠存取某些裝置檔案的主控台使用者具有損毀可錄製 CD 光碟機的能力。已將 pam_console 處理這些檔案之權限的方式修改為不允許存取。此變更也需要修改 cdrecord 應用程式。
(CVE-2004-0813)

在 pam_console 設定主控台裝置權限的方式中發現一個瑕疵。數個主控台裝置可能在登出後取得主控台使用者的擁有權，並可能將資訊洩漏給未經授權的使用者。(CVE-2007-1716)

pam_unix 模組提供對於標準 /etc/passwd 與 /etc/shadow 檔案的驗證。pam_stack 模組提供對於堆疊 PAM 組態檔案的支援。這些模組都發生了少量記憶體洩漏，這導致應用程式在某些處理程序中重複呼叫 PAM 驗證時發生問題。

來自 Red Hat 安全性公告 2007:0465：

現已提供適用於 Red Hat Enterprise Linux 3 的更新版 pam 套件，可解決數個錯誤和安全性瑕疵。

Red Hat 安全性回應團隊已將此更新評等為具有中等安全性影響。

插入式驗證模組 (PAM) 提供一個系統，讓系統管理員可在不重新編譯用於處理驗證之程式的情況下，直接設定驗證原則。

在 Linux 核心處理某些 SG_IO 命令的方式中發現一個瑕疵。能夠存取某些裝置檔案的主控台使用者具有損毀可錄製 CD 光碟機的能力。已將 pam_console 處理這些檔案之權限的方式修改為不允許存取。此變更也需要修改 cdrecord 應用程式。
(CVE-2004-0813)

在 pam_console 設定主控台裝置權限的方式中發現一個瑕疵。數個主控台裝置可能在登出後取得主控台使用者的擁有權，並可能將資訊洩漏給未經授權的使用者。(CVE-2007-1716)

pam_unix 模組提供對於標準 /etc/passwd 與 /etc/shadow 檔案的驗證。pam_stack 模組提供對於堆疊 PAM 組態檔案的支援。這些模組都發生了少量記憶體洩漏，這導致應用程式在某些處理程序中重複呼叫 PAM 驗證時發生問題。

所有 PAM 使用者皆應升級至這些更新版套件，其可解決這些問題。

The remote host is affected by the vulnerability described in GLSA-200711-23 (VMware Workstation and Player: Multiple vulnerabilities)

    Multiple vulnerabilities have been discovered in several VMware     products. Neel Mehta and Ryan Smith (IBM ISS X-Force) discovered that     the DHCP server contains an integer overflow vulnerability     (CVE-2007-0062), an integer underflow vulnerability (CVE-2007-0063) and     another error when handling malformed packets (CVE-2007-0061), leading     to stack-based buffer overflows or stack corruption. Rafal Wojtczvk     (McAfee) discovered two unspecified errors that allow authenticated     users with administrative or login privileges on a guest operating     system to corrupt memory or cause a Denial of Service (CVE-2007-4496,     CVE-2007-4497). Another unspecified vulnerability related to untrusted     virtual machine images was discovered (CVE-2007-5617).
    VMware products also shipped code copies of software with several     vulnerabilities: Samba (GLSA-200705-15), BIND (GLSA-200702-06), MIT     Kerberos 5 (GLSA-200707-11), Vixie Cron (GLSA-200704-11), shadow     (GLSA-200606-02), OpenLDAP (CVE-2006-4600), PAM (CVE-2004-0813,     CVE-2007-1716), GCC (CVE-2006-3619) and GDB (CVE-2006-4146).
  Impact :

    Remote attackers within a guest system could possibly exploit these     vulnerabilities to execute code on the host system with elevated     privileges or to cause a Denial of Service.
  Workaround :

    There is no known workaround at this time.

Problems addressed by these patches :

I    Arbitrary code execution and denial of service vulnerabilities

     This release fixes a security vulnerability that could allow a      guest operating system user with administrative privileges to cause      memory corruption in a host process, and thus potentially execute      arbitrary code on the host. (CVE-2007-4496)

     This release fixes a denial of service vulnerability that could      allow a guest operating system to cause a host process to become      unresponsive or exit unexpectedly. (CVE-2007-4497)

     Thanks to Rafal Wojtczvk of McAfee for identifying and reporting      these issues.

II   Hosted products DHCP security vulnerabilities addressed

     This release fixes several vulnerabilities in the DHCP server      that could enable a specially crafted packets to gain system-level      privileges. (CVE-2007-0061, CVE-2007-0062, CVE-2007-0063)

     Thanks to Neel Mehta and Ryan Smith of the IBM Internet Security      Systems X-Force for discovering and researching these      vulnerabilities.

III  Windows based hosted product vulnerability in      IntraProcessLogging.dll and vielib.dll.

     This release fixes a security vulnerability that could allow a      malicious remote user to exploit the library file      IntraProcessLogging.dll to overwrite files in a system.
     (CVE-2007-4059)

     This release fixes a security vulnerability that could allow a      malicious remote user to exploit the library file vielib.dll to      overwrite files in a system. (CVE-2007-4155)

     Thanks to the Goodfellas Security Research Team for discovering and      researching these vulnerabilities.

IV  Escalation of privileges on Windows hosted systems

     This release fixes a security vulnerability in which Workstation      was starting registered Windows services in an insecure manner.
     This vulnerability could allow a malicious user to escalate user      privileges.

     Thanks to Foundstone for discovering this vulnerability.

V    Potential denial of service using VMware Player

     This release fixes a problem that prevented VMware Player from      launching. This problem was accompanied by the error message VMware      Player unrecoverable error: (player) Exception 0xc0000005 (access      violation) has occurred.

VI   ESX Service Console updates

a.   Service console package Samba, has been updated to address the      following issues :

     Various bugs were found in NDR parsing, used to decode MS-RPC      requests in Samba. A remote attacker could have sent carefully      crafted requests causing a heap overflow, which may have led to the      ability to execute arbitrary code on the server. (CVE-2007-2446)

     Unescaped user input parameters were being passed as arguments to      /bin/sh. A remote, authenticated, user could have triggered this      flaw and executed arbitrary code on the server. Additionally, this      flaw could be triggered by a remote unauthenticated user if Samba      was configured to use the non-default username map script option.
     (CVE-2007-2447)

     Thanks to the Samba developers, TippingPoint, and iDefense for      identifying and reporting these issues.

     Note: These issues only affect the service console network, and are      not remote vulnerabilities for ESX Server hosts that have been set      up with the security best practices provided by VMware.
     http://www.vmware.com/resources/techresources/726

b.   Updated bind package for the service console fixes a flaw with the      way ISC BIND processed certain DNS query responses.

     ISC BIND (Berkeley Internet Name Domain) is an implementation of      the DNS (Domain Name System) protocols. Under some circumstances, a      malicious remote user could launch a Denial-of-Service attack on      ESX Server hosts that had enabled DNSSEC validation.
     (CVE-2007-0494)

     Note: These issues only affect the service console network, and are      not remote vulnerabilities for ESX Server hosts that have been set      up with the security best practices provided by VMware.
     http://www.vmware.com/resources/techresources/726

c.   This patch provides updated service console package krb5 update.

     The Common Vulnerabilities and Exposures project (cve.mitre.org)      assigned the names CVE-2007-2442, CVE-2007-2443, and CVE-2007-2798      to these security issues.

     Thanks to Wei Wang of McAfee Avert Labs discovered these      vulnerabilities.

     Note: The VMware service console does not provide the kadmind      binary, and is not affected by these issues, but a update has been      provided for completeness.

d.   Service console update for vixie-cron

     This patch provides an updated service console package vixie-cron.
     Cron is a standard UNIX daemon that runs specified programs at      scheduled times.

     A denial of service issue was found in the way vixie-cron verified      crontab file integrity. A local user with the ability to create a      hardlink to /etc/crontab could potentially prevent vixie-cron from      executing certain system cron jobs. (CVE-2007-1856)

     Thanks to Raphael Marichez for identifying this issue.

e.   Service console update for shadow-utils

     This patch provides an updated shadow-utils package.  A new      user's mailbox, when created, could have random permissions for a      short period. This could enable a local malicious user to      read or modify the mailbox. (CVE-2006-1174)

f.  Service console update for OpenLDAP

     This patch provides a updated OpenLDAP package. A flaw could      allow users with selfwrite access to modify the distinguished      name of any user, instead of being limited to modify only      their own distinguished name. (CVE-2006-4600)

g.   Service console update for PAM

     This patch provides an updated PAM package A vulnerability was      found that could allow console users with access to certain device      files to cause damage to recordable CD drives. Certain file      permissions have now been modified to disallow access.
     (CVE-2004-0813)

     A flaw was found with console device permissions. It was possible      for various console devices to retain ownership of the previoius      console user after logging out, which could result in leakage of      information to an unauthorized user. (CVE-2007-1716)

h.   Service console update for GCC

     This patch provides security fixes for the service console GNU      Compiler Collection (GCC) packages that include C, C++, Java,      Fortran 77, Objective C, and Ada 95 GNU compilers and related      support libraries.

     A flaw was found in the fastjar utility that could potentially      allow a malicious user to create a JAR file which, if unpacked      using fastjar, could write to any file that an authorized user had      write access to. (CVE-2006-3619)

     Thanks to J&uuml;rgen Weigert for identifying this issue.

i.   Service Console update for GDB

     This patch provides a security fix for the service console GNU      debugger (GDB).  Various vulnerabilities were found in GDB. These      vulnerabilities may allow a malicious user to deceive a user into      loading debugging information into GDB, enabling the execution of      arbitrary code with the privileges of the user. (CVE-2006-4146)

在 Linux 内核处理某些 SG_IO 命令的方式中发现一个缺陷。具有访问某些设备文件的权限的控制台用户能够损坏可录制 CD 驱动器。pam_console 处理这些文件权限的方式已修改为禁止访问。此更改还需要修改 cdrecord 应用程序。
(CVE-2004-0813)

在 pam_console 设置控制台设备权限的方式中发现一个缺陷。各个控制台设备在注销后可保留控制台用户的所有权，从而可能会将信息泄漏给未经授权的用户。(CVE-2007-1716)

pam_unix 模块根据标准 /etc/passwd and /etc/shadow 文件执行认证。pam_stack 模块支持堆叠 PAM 配置文件。这两个模块包含少量内存泄漏，导致在同一进程中重复调用 PAM 认证的应用程序发生问题。

来自 Red Hat 安全公告 2007:0465：

更新后的 pam 程序包解决了多个缺陷和安全缺陷，现在可用于 Red Hat Enterprise Linux 3。

Red Hat 安全响应团队将此更新评级为具有中等安全影响。

可插拔认证模块 (PAM) 为系统提供以下功能：管理员不必重新编译用于处理认证的程序即可设置认证策略系统。

在 Linux 内核处理某些 SG_IO 命令的方式中发现一个缺陷。具有访问某些设备文件的权限的控制台用户能够损坏可录制 CD 驱动器。pam_console 处理这些文件权限的方式已修改为禁止访问。此更改还需要修改 cdrecord 应用程序。
(CVE-2004-0813)

在 pam_console 设置控制台设备权限的方式中发现一个缺陷。各个控制台设备在注销后可保留控制台用户的所有权，从而可能会将信息泄漏给未经授权的用户。(CVE-2007-1716)

pam_unix 模块根据标准 /etc/passwd and /etc/shadow 文件执行认证。pam_stack 模块支持堆叠 PAM 配置文件。这两个模块包含少量内存泄漏，导致在同一进程中重复调用 PAM 认证的应用程序发生问题。

所有 PAM 用户应升级这些更新后的程序包，其中解决了这些问题。

ID	名称	产品	系列	发布时间	最近更新时间	严重程度
25480	RHEL 3 : pam (RHSA-2007:0465)	Nessus	Red Hat Local Security Checks	2007/6/12	2021/1/14	low
25499	CentOS 3 : pam (CESA-2007:0465)	Nessus	CentOS Local Security Checks	2007/6/14	2021/1/4	low
60202	Scientific Linux セキュリティ更新：SL3.x i386/x86_64 の pam	Nessus	Scientific Linux Local Security Checks	2012/8/1	2021/1/14	low
67517	Oracle Linux 3：pam（ELSA-2007-0465）	Nessus	Oracle Linux Local Security Checks	2013/7/12	2021/1/14	low
60202	Scientific Linux Security Update : pam on SL3.x i386/x86_64	Nessus	Scientific Linux Local Security Checks	2012/8/1	2021/1/14	low
67517	Oracle Linux 3 : pam (ELSA-2007-0465)	Nessus	Oracle Linux Local Security Checks	2013/7/12	2021/1/14	low
60202	Scientific Linux 安全性更新：SL3.x i386/x86_64 上的 pam	Nessus	Scientific Linux Local Security Checks	2012/8/1	2021/1/14	low
67517	Oracle Linux 3 : pam (ELSA-2007-0465)	Nessus	Oracle Linux Local Security Checks	2013/7/12	2021/1/14	low
28262	GLSA-200711-23 : VMware Workstation and Player: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	2007/11/20	2021/1/6	critical
40370	VMSA-2007-0006 : Critical security updates for all supported versions of VMware ESX Server, VMware Server, VMware Workstation, VMware ACE, and VMware Player	Nessus	VMware ESX Local Security Checks	2009/7/27	2021/1/6	critical
60202	Scientific Linux 安全更新：SL3.x i386/x86_64 中的 pam	Nessus	Scientific Linux Local Security Checks	2012/8/1	2021/1/14	low
67517	Oracle Linux 3：pam (ELSA-2007-0465)	Nessus	Oracle Linux Local Security Checks	2013/7/12	2021/1/14	low

检测

插件搜索

low

low

low

low

low

low

low

low

critical

critical

low

low