Users of PAM please be advised of a Moderate security update fix vulnerability that has been identified.
To view this vulnerability, possible remedies, and others please check out the Security Advisories at Critical Watch (http://criticalwatch.com/support/security-advisories.aspx)
Amplify’d from www.criticalwatch.com
RHSA-2010:0891-01: [RHSA-2010:0891-01] Moderate: pam security update
Product: Red Hat Enterprise Linux
It was discovered that the pam_namespace module executed the external
script namespace.init with an unchanged environment inherited from an
application calling PAM. In cases where such an environment was untrusted
(for example, when pam_namespace was configured for setuid applications
such as su or sudo), a local, unprivileged user could possibly use thisflaw to escalate their privileges. (CVE-2010-3853)
It was discovered that the pam_xauth module did not verify the return
values of the setuid() and setgid() system calls. A local, unprivileged
user could use this flaw to execute the xauth command with root privilegesand make it read an arbitrary input file. (CVE-2010-3316)Read more at www.criticalwatch.com
See this Amp at http://bit.ly/bMdzk4
No comments:
Post a Comment