full-disclosure - [ MDVSA-2011:019 ] libuser

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives
Hash Suite: Windows password security audit tool. GUI, reports in PDF.
[<prev] [next>] [day] [month] [year] [list]
Message-Id: <E1Pi8qf-0001Sw-64@titan.mandriva.com>
Date: Wed, 26 Jan 2011 18:08:00 +0100
From: security@...driva.com
To: full-disclosure@...ts.grok.org.uk
Subject: [ MDVSA-2011:019 ] libuser

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

 _______________________________________________________________________

 Mandriva Linux Security Advisory                         MDVSA-2011:019
 http://www.mandriva.com/security/
 _______________________________________________________________________

 Package : libuser
 Date    : January 26, 2011
 Affected: 2009.0, 2010.0, 2010.1, Corporate 4.0, Enterprise Server 5.0
 _______________________________________________________________________

 Problem Description:

 A vulnerability has been found and corrected in libuser:
 
 libuser before 0.57 uses a cleartext password value of (1) !! or (2) x
 for new LDAP user accounts, which makes it easier for remote attackers
 to obtain access by specifying one of these values (CVE-2011-0002).
 
 Packages for 2009.0 are provided as of the Extended Maintenance
 Program. Please visit this link to learn more:
 http://store.mandriva.com/product_info.php?cPath=149&amp;products_id=490
 
 The updated packages have been patched to correct this issue.
 _______________________________________________________________________

 References:

 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-0002
 _______________________________________________________________________

 Updated Packages:

 Mandriva Linux 2009.0:
 ca70c36b0b0d92777fd018d6f3cdd6e2  2009.0/i586/libuser-0.56.9-2.1mdv2009.0.i586.rpm
 43123c3c58d55604307834fd7ada929c  2009.0/i586/libuser1-0.56.9-2.1mdv2009.0.i586.rpm
 f3cfd126ba0c48a73462950fc50588de  2009.0/i586/libuser-devel-0.56.9-2.1mdv2009.0.i586.rpm
 fa5bb059a1d0dd7d58b1d7057e5c0f7f  2009.0/i586/libuser-ldap-0.56.9-2.1mdv2009.0.i586.rpm
 508e8b5bb1fd7e40f078842198f0f7e3  2009.0/i586/libuser-python-0.56.9-2.1mdv2009.0.i586.rpm 
 6195ca448d84b938fe21d1f2edf1378f  2009.0/SRPMS/libuser-0.56.9-2.1mdv2009.0.src.rpm

 Mandriva Linux 2009.0/X86_64:
 7c97f6e1a82f6674873388e6c2ccb235  2009.0/x86_64/lib64user1-0.56.9-2.1mdv2009.0.x86_64.rpm
 37abe1149c3e6e602cfd1e9621e03e82  2009.0/x86_64/lib64user-devel-0.56.9-2.1mdv2009.0.x86_64.rpm
 5e46fc7dd4d31d6a05f221b14899109c  2009.0/x86_64/libuser-0.56.9-2.1mdv2009.0.x86_64.rpm
 8a5e9ae3b52cca038070b411eb38b870  2009.0/x86_64/libuser-ldap-0.56.9-2.1mdv2009.0.x86_64.rpm
 f42063e6d27cad1685d9b66021e8328e  2009.0/x86_64/libuser-python-0.56.9-2.1mdv2009.0.x86_64.rpm 
 6195ca448d84b938fe21d1f2edf1378f  2009.0/SRPMS/libuser-0.56.9-2.1mdv2009.0.src.rpm

 Mandriva Linux 2010.0:
 1390c942454ebf498ce5567283850e7e  2010.0/i586/libuser-0.56.11-1.1mdv2010.0.i586.rpm
 054618569e80a6e1767d5e6529399d23  2010.0/i586/libuser1-0.56.11-1.1mdv2010.0.i586.rpm
 1190320b655c4187f7fded7db74faed3  2010.0/i586/libuser-devel-0.56.11-1.1mdv2010.0.i586.rpm
 ba9f0a4af374c840a953de2ac46c80fb  2010.0/i586/libuser-ldap-0.56.11-1.1mdv2010.0.i586.rpm
 41cc3b8d5a823e4a704cfb282fa9c76a  2010.0/i586/libuser-python-0.56.11-1.1mdv2010.0.i586.rpm 
 2694df315cb32a260064d024722beec9  2010.0/SRPMS/libuser-0.56.11-1.1mdv2010.0.src.rpm

 Mandriva Linux 2010.0/X86_64:
 85d05e42080e8ad098261b7f10626f1a  2010.0/x86_64/lib64user1-0.56.11-1.1mdv2010.0.x86_64.rpm
 e2f2f311c3e00680b68f40e5189f4b3f  2010.0/x86_64/lib64user-devel-0.56.11-1.1mdv2010.0.x86_64.rpm
 491f4e0c92f99e68ab2ba60dd969e10d  2010.0/x86_64/libuser-0.56.11-1.1mdv2010.0.x86_64.rpm
 f63768ddb727e3bf9b201756747e4f5e  2010.0/x86_64/libuser-ldap-0.56.11-1.1mdv2010.0.x86_64.rpm
 74fa01df91da0fd1b9d37a7bcd91116d  2010.0/x86_64/libuser-python-0.56.11-1.1mdv2010.0.x86_64.rpm 
 2694df315cb32a260064d024722beec9  2010.0/SRPMS/libuser-0.56.11-1.1mdv2010.0.src.rpm

 Mandriva Linux 2010.1:
 5c942ad8edeaea55a2091479838f602f  2010.1/i586/libuser-0.56.15-3.1mdv2010.2.i586.rpm
 6f3c60d4bdc1acb67a5ac4e4593c7610  2010.1/i586/libuser1-0.56.15-3.1mdv2010.2.i586.rpm
 191f919d23e87ed4108691778c34f082  2010.1/i586/libuser-devel-0.56.15-3.1mdv2010.2.i586.rpm
 b89cb7b101b523807d5b78aba657a724  2010.1/i586/libuser-ldap-0.56.15-3.1mdv2010.2.i586.rpm
 1d6e2b68af335fc1ad493d96854d3df9  2010.1/i586/libuser-python-0.56.15-3.1mdv2010.2.i586.rpm 
 9e651f9eeb0978d060ad26e254c11b64  2010.1/SRPMS/libuser-0.56.15-3.1mdv2010.2.src.rpm

 Mandriva Linux 2010.1/X86_64:
 45205a3cf4cf90c8fc45bfb5b3f544ed  2010.1/x86_64/lib64user1-0.56.15-3.1mdv2010.2.x86_64.rpm
 b90aab76a88221ed42dfa51272294d91  2010.1/x86_64/lib64user-devel-0.56.15-3.1mdv2010.2.x86_64.rpm
 8c1dbfacfe98699d30d1b6c3e83b966e  2010.1/x86_64/libuser-0.56.15-3.1mdv2010.2.x86_64.rpm
 68294d567786b431654d1b7ec0850214  2010.1/x86_64/libuser-ldap-0.56.15-3.1mdv2010.2.x86_64.rpm
 1b12f17a64c7df7840fbd81f8657c979  2010.1/x86_64/libuser-python-0.56.15-3.1mdv2010.2.x86_64.rpm 
 9e651f9eeb0978d060ad26e254c11b64  2010.1/SRPMS/libuser-0.56.15-3.1mdv2010.2.src.rpm

 Corporate 4.0:
 9070225e84b5ec4c97728927d58b9434  corporate/4.0/i586/libuser-0.53.2-6.1.20060mlcs4.i586.rpm
 3fca7372f85b38bfb55a9e1e10c75ec0  corporate/4.0/i586/libuser1-0.53.2-6.1.20060mlcs4.i586.rpm
 7ffeb054b227ea45e44bacbcd7438a53  corporate/4.0/i586/libuser1-devel-0.53.2-6.1.20060mlcs4.i586.rpm
 5024fc1f8f479523de5df0123e11fe89  corporate/4.0/i586/libuser-ldap-0.53.2-6.1.20060mlcs4.i586.rpm
 30d7fa230a2f47e325ea375e70752e19  corporate/4.0/i586/libuser-python-0.53.2-6.1.20060mlcs4.i586.rpm 
 f1682ded4b626754df6cc6473188a67a  corporate/4.0/SRPMS/libuser-0.53.2-6.1.20060mlcs4.src.rpm

 Corporate 4.0/X86_64:
 c0b394abc4fa5166486f04144d2608bb  corporate/4.0/x86_64/lib64user1-0.53.2-6.1.20060mlcs4.x86_64.rpm
 88a8eeeebf4ab9858a92a49cc64ea473  corporate/4.0/x86_64/lib64user1-devel-0.53.2-6.1.20060mlcs4.x86_64.rpm
 338cc3bd6928f941e500894a0f4fd2ec  corporate/4.0/x86_64/libuser-0.53.2-6.1.20060mlcs4.x86_64.rpm
 277e2f281f1bdc3d7eab6df61353622d  corporate/4.0/x86_64/libuser-ldap-0.53.2-6.1.20060mlcs4.x86_64.rpm
 f2f6ee658734f4b99c6c2aca5f6555ec  corporate/4.0/x86_64/libuser-python-0.53.2-6.1.20060mlcs4.x86_64.rpm 
 f1682ded4b626754df6cc6473188a67a  corporate/4.0/SRPMS/libuser-0.53.2-6.1.20060mlcs4.src.rpm

 Mandriva Enterprise Server 5:
 08fd1e0c14e5c86e418a23ad27401482  mes5/i586/libuser-0.56.9-2.1mdvmes5.1.i586.rpm
 36eddbc333424b33c449b8d1c3befc7d  mes5/i586/libuser1-0.56.9-2.1mdvmes5.1.i586.rpm
 2279332ac99a92a8887466261723fc35  mes5/i586/libuser-devel-0.56.9-2.1mdvmes5.1.i586.rpm
 1e86f7af7fa2319faa4b4325ecf50af1  mes5/i586/libuser-ldap-0.56.9-2.1mdvmes5.1.i586.rpm
 c8797fd70e4bac0fad491dbc637c1bed  mes5/i586/libuser-python-0.56.9-2.1mdvmes5.1.i586.rpm 
 4737264ba1e04fd2113929a3a870bc7a  mes5/SRPMS/libuser-0.56.9-2.1mdvmes5.1.src.rpm

 Mandriva Enterprise Server 5/X86_64:
 e4b5455914906b5e4a02f4e0bcc2cf84  mes5/x86_64/lib64user1-0.56.9-2.1mdvmes5.1.x86_64.rpm
 6c48c50ddcac7db31866e4f0564c8b02  mes5/x86_64/lib64user-devel-0.56.9-2.1mdvmes5.1.x86_64.rpm
 1bde510f65afa24f88a736fd6ce80792  mes5/x86_64/libuser-0.56.9-2.1mdvmes5.1.x86_64.rpm
 2599076762dd6552b0d873fa883b3256  mes5/x86_64/libuser-ldap-0.56.9-2.1mdvmes5.1.x86_64.rpm
 52f2f33b577bbac0be8fdcbb8548a627  mes5/x86_64/libuser-python-0.56.9-2.1mdvmes5.1.x86_64.rpm 
 4737264ba1e04fd2113929a3a870bc7a  mes5/SRPMS/libuser-0.56.9-2.1mdvmes5.1.src.rpm
 _______________________________________________________________________

 To upgrade automatically use MandrivaUpdate or urpmi.  The verification
 of md5 checksums and GPG signatures is performed automatically for you.

 All packages are signed by Mandriva for security.  You can obtain the
 GPG public key of the Mandriva Security Team by executing:

  gpg --recv-keys --keyserver pgp.mit.edu 0x22458A98

 You can view other update advisories for Mandriva Linux at:

  http://www.mandriva.com/security/advisories

 If you want to report vulnerabilities, please contact

  security_(at)_mandriva.com
 _______________________________________________________________________

 Type Bits/KeyID     Date       User ID
 pub  1024D/22458A98 2000-07-10 Mandriva Security Team
  <security*mandriva.com>
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.9 (GNU/Linux)

iD8DBQFNQCRpmqjQ0CJFipgRAlCPAKCnhM95ruMCqhmlagQtf74j8JZF7ACfcIaO
oWiDxxTET0vgcarHfwgKBAs=
=q2du
-----END PGP SIGNATURE-----

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/