From: Secunia Security Advisories (sec-advsecunia.com)
Date: Fri Jul 11 2003 - 04:38:45 CDT

• Messages sorted by: [ date ] [ thread ] [ subject ] [ author ]

TITLE:
Conectiva update for pam

READ ONLINE:
http://www.secunia.com/advisories/9233/

CRITICAL:
Less critical

IMPACT:
Privilege escalation

WHERE:
Local system

OPERATING SYSTEM:
Conectiva Linux 8

DESCRIPTION:
Conectiva has issued updated packages for pam, which fix a problem
with "pam_xauth" cookies.

The problem is that if the user "root" su to a less privileged user,
then root's xauth cookies is forwarded by pam. The less privileged
user could then steal the xauth cookie and connect to the X server as
user "root".

SOLUTION:
Updated packages:

ftp://atualizacoes.conectiva.com.br/8/RPMS/pam-0.75-5U80_1cl.i386.rpm
ftp://atualizacoes.conectiva.com.br/8/RPMS/pam-devel-0.75-5U80_1cl.i386.rpm
ftp://atualizacoes.conectiva.com.br/8/RPMS/pam-devel-static-0.75-5U80_1cl.i386.rpm

SRPM:
ftp://atualizacoes.conectiva.com.br/8/SRPMS/pam-0.75-5U80_1cl.src.rpm

----------------------------------------------------------------------

Secunia recommends that you verify all advisories you receive, by
clicking the link.
Secunia NEVER sends attached files with advisories.
Secunia does not advise people to install third party patches, only
use those supplied by the vendor.

Contact details:
Web : http://www.secunia.com/
E-mail : supportsecunia.com
Tel : +44 (0) 20 7016 2693
Fax : +44 (0) 20 7637 0419

----------------------------------------------------------------------

Unsubscribe: Secunia Security Advisories

----------------------------------------------------------------------

• Messages sorted by: [ date ] [ thread ] [ subject ] [ author ]