[ MDKA-2006:119 ] - Updated ppp packages fix plugin vulnerability
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
_______________________________________________________________________
Mandriva Linux Security Advisory MDKA-2006:119
http://www.mandriva.com/security/
_______________________________________________________________________
Package : ppp
Date : July 10, 2006
Affected: 2006.0
_______________________________________________________________________
Problem Description:
Marcus Meissner discovered that pppd's winbind plugin did not check for
the result of the setuid() call which could allow an attacker to
exploit this on systems with certain PAM limits enabled to execute the
NTLM authentication helper as root. This could possibly lead to
privilege escalation dependant upon the local winbind configuration.
Updated packages have been patched ot correct this issue.
_______________________________________________________________________
References:
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-2194
_______________________________________________________________________
Updated Packages:
Mandriva Linux 2006.0:
75455046d94e92441bbe2e0e2b773082 2006.0/RPMS/ppp-2.4.3-9.1.20060mdk.i586.rpm
f567cca02725deb575a8f13452234664
2006.0/RPMS/ppp-devel-2.4.3-9.1.20060mdk.i586.rpm
8872f55ecea3ba6e001c4bca4972199e
2006.0/RPMS/ppp-dhcp-2.4.3-9.1.20060mdk.i586.rpm
a741c885635d908b200a1bf60232b71f
2006.0/RPMS/ppp-pppoatm-2.4.3-9.1.20060mdk.i586.rpm
058a637fd471f0a4f2791fbbfe2f763b
2006.0/RPMS/ppp-pppoe-2.4.3-9.1.20060mdk.i586.rpm
3e0a3e901f9cab4fa879fec18fb6ac92
2006.0/RPMS/ppp-prompt-2.4.3-9.1.20060mdk.i586.rpm
b2ed30cae68e544fc63c794742577f1a
2006.0/RPMS/ppp-radius-2.4.3-9.1.20060mdk.i586.rpm
2578865b6af5300d3027aa62eaa1466b 2006.0/SRPMS/ppp-2.4.3-9.1.20060mdk.src.rpm
Mandriva Linux 2006.0/X86_64:
b00f91f85a11f75dfb3a038a15fee3e5
x86_64/2006.0/RPMS/ppp-2.4.3-9.1.20060mdk.x86_64.rpm
63c00cf07b9b2729e4820fb270372800
x86_64/2006.0/RPMS/ppp-devel-2.4.3-9.1.20060mdk.x86_64.rpm
90fe962badb7773bc747b2a595c42e2e
x86_64/2006.0/RPMS/ppp-dhcp-2.4.3-9.1.20060mdk.x86_64.rpm
24074e562bef8364308931f71cd66644
x86_64/2006.0/RPMS/ppp-pppoatm-2.4.3-9.1.20060mdk.x86_64.rpm
cf3ec260bf90e2b086fa02d4267bc5c2
x86_64/2006.0/RPMS/ppp-pppoe-2.4.3-9.1.20060mdk.x86_64.rpm
5455b8bd4daf610893ff36031ead5167
x86_64/2006.0/RPMS/ppp-prompt-2.4.3-9.1.20060mdk.x86_64.rpm
2dcb7f91af4fddeec7b83b396cd4d7f0
x86_64/2006.0/RPMS/ppp-radius-2.4.3-9.1.20060mdk.x86_64.rpm
2578865b6af5300d3027aa62eaa1466b
x86_64/2006.0/SRPMS/ppp-2.4.3-9.1.20060mdk.src.rpm
_______________________________________________________________________
To upgrade automatically use MandrivaUpdate or urpmi. The verification
of md5 checksums and GPG signatures is performed automatically for you.
All packages are signed by Mandriva for security. You can obtain the
GPG public key of the Mandriva Security Team by executing:
gpg --recv-keys --keyserver pgp.mit.edu 0x22458A98
You can view other update advisories for Mandriva Linux at:
http://www.mandriva.com/security/advisories
If you want to report vulnerabilities, please contact
security_(at)_mandriva.com
_______________________________________________________________________
Type Bits/KeyID Date User ID
pub 1024D/22458A98 2000-07-10 Mandriva Security Team
<security*mandriva.com>
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.2.2 (GNU/Linux)
iD8DBQFEswtAmqjQ0CJFipgRAjifAKDKvH8Gv/mS+pooTMJbQb7KN3Di7wCg9pmY
F1TbQTxk905x7K8bqg0ddi0=
=y43d
-----END PGP SIGNATURE-----