full-disclosure - [ MDKA-2006:119 ] - Updated ppp packages fix plugin vulnerability

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <E1G0Aky-0006eC-M5@mercury.mandriva.com>
Date: Tue Jul 11 06:26:12 2006
From: security at mandriva.com (security@...driva.com)
Subject: [ MDKA-2006:119 ] - Updated ppp packages fix
	plugin vulnerability


-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

 _______________________________________________________________________
 
 Mandriva Linux Security Advisory                          MDKA-2006:119
 http://www.mandriva.com/security/
 _______________________________________________________________________
 
 Package : ppp
 Date    : July 10, 2006
 Affected: 2006.0
 _______________________________________________________________________
 
 Problem Description:
 
 Marcus Meissner discovered that pppd's winbind plugin did not check for
 the result of the setuid() call which could allow an attacker to
 exploit this on systems with certain PAM limits enabled to execute the
 NTLM authentication helper as root.  This could possibly lead to
 privilege escalation dependant upon the local winbind configuration.
 
 Updated packages have been patched ot correct this issue.
 _______________________________________________________________________

 References:
 
 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-2194
 _______________________________________________________________________
 
 Updated Packages:
 
 Mandriva Linux 2006.0:
 75455046d94e92441bbe2e0e2b773082  2006.0/RPMS/ppp-2.4.3-9.1.20060mdk.i586.rpm
 f567cca02725deb575a8f13452234664  2006.0/RPMS/ppp-devel-2.4.3-9.1.20060mdk.i586.rpm
 8872f55ecea3ba6e001c4bca4972199e  2006.0/RPMS/ppp-dhcp-2.4.3-9.1.20060mdk.i586.rpm
 a741c885635d908b200a1bf60232b71f  2006.0/RPMS/ppp-pppoatm-2.4.3-9.1.20060mdk.i586.rpm
 058a637fd471f0a4f2791fbbfe2f763b  2006.0/RPMS/ppp-pppoe-2.4.3-9.1.20060mdk.i586.rpm
 3e0a3e901f9cab4fa879fec18fb6ac92  2006.0/RPMS/ppp-prompt-2.4.3-9.1.20060mdk.i586.rpm
 b2ed30cae68e544fc63c794742577f1a  2006.0/RPMS/ppp-radius-2.4.3-9.1.20060mdk.i586.rpm
 2578865b6af5300d3027aa62eaa1466b  2006.0/SRPMS/ppp-2.4.3-9.1.20060mdk.src.rpm

 Mandriva Linux 2006.0/X86_64:
 b00f91f85a11f75dfb3a038a15fee3e5  x86_64/2006.0/RPMS/ppp-2.4.3-9.1.20060mdk.x86_64.rpm
 63c00cf07b9b2729e4820fb270372800  x86_64/2006.0/RPMS/ppp-devel-2.4.3-9.1.20060mdk.x86_64.rpm
 90fe962badb7773bc747b2a595c42e2e  x86_64/2006.0/RPMS/ppp-dhcp-2.4.3-9.1.20060mdk.x86_64.rpm
 24074e562bef8364308931f71cd66644  x86_64/2006.0/RPMS/ppp-pppoatm-2.4.3-9.1.20060mdk.x86_64.rpm
 cf3ec260bf90e2b086fa02d4267bc5c2  x86_64/2006.0/RPMS/ppp-pppoe-2.4.3-9.1.20060mdk.x86_64.rpm
 5455b8bd4daf610893ff36031ead5167  x86_64/2006.0/RPMS/ppp-prompt-2.4.3-9.1.20060mdk.x86_64.rpm
 2dcb7f91af4fddeec7b83b396cd4d7f0  x86_64/2006.0/RPMS/ppp-radius-2.4.3-9.1.20060mdk.x86_64.rpm
 2578865b6af5300d3027aa62eaa1466b  x86_64/2006.0/SRPMS/ppp-2.4.3-9.1.20060mdk.src.rpm
 _______________________________________________________________________

 To upgrade automatically use MandrivaUpdate or urpmi.  The verification
 of md5 checksums and GPG signatures is performed automatically for you.

 All packages are signed by Mandriva for security.  You can obtain the
 GPG public key of the Mandriva Security Team by executing:

  gpg --recv-keys --keyserver pgp.mit.edu 0x22458A98

 You can view other update advisories for Mandriva Linux at:

  http://www.mandriva.com/security/advisories

 If you want to report vulnerabilities, please contact

  security_(at)_mandriva.com
 _______________________________________________________________________

 Type Bits/KeyID     Date       User ID
 pub  1024D/22458A98 2000-07-10 Mandriva Security Team
  <security*mandriva.com>
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.2.2 (GNU/Linux)

iD8DBQFEswtAmqjQ0CJFipgRAjifAKDKvH8Gv/mS+pooTMJbQb7KN3Di7wCg9pmY
F1TbQTxk905x7K8bqg0ddi0=
=y43d
-----END PGP SIGNATURE-----