Table of Contents
Advertisement
1.148. pam
1.148.1. RHBA-2010:0135: bug fix update
Note
This update has already been released (prior to the GA of this release) as errata
RHBA-2010:0135
Updated pam packages that fix a bug in the pam_time and pam_group modules are now available.
Pluggable Authentication Modules (PAM) provide a system whereby administrators can set up
authentication policies, without having to recompile programs to handle authentication.
These updated packages fix the following bug:
* the pam_time and pam_group modules, which support allowing or rejecting authentication based
on time and assigning group names respectively, incorrectly matched user, service, or terminal name
substrings even if no wildcard was specified in the configuration. For example, "user" and "user1"
were incorrectly equated, causing policies to apply to both usernames even when "user" was the only
username subject to said policies. This update improves the string matching in the pam_time and
pam_group modules ensuring such mis-matches (and consequent policy mis-applications) no longer
1648
occur.
(BZ#571341
All pam users are advised to upgrade to these updated packages, which resolve this issue.
1.149. pam_krb5
1.149.1. RHSA-2010:0258: Low security and bug fix update
Updated pam_krb5 packages that fix one security issue and various bugs are now available for Red
Hat Enterprise Linux 5.
The Red Hat Security Response Team has rated this update as having low security impact. A
Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is
available from the CVE link in the References section.
The pam_krb5 module allows Pluggable Authentication Modules (PAM) aware applications to use
Kerberos to verify user identities by obtaining user credentials at log in time.
A flaw was found in pam_krb5. In some non-default configurations (specifically, those where pam_krb5
would be the first module to prompt for a password), the text of the password prompt varied based
on whether or not the username provided was a username known to the system. A remote attacker
could use this flaw to recognize valid usernames, which would aid a dictionary-based password guess
attack.
(CVE-2009-1384
This update also fixes the following bugs:
1648
https://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=571341
1649
https://www.redhat.com/security/data/cve/CVE-2009-1384.html
1647
)
1649
)
pam
201
Advertisement
Table of Contents
