|
|
| Problem Description |
Pam_ldap does not return an error condition when an LDAP directory
server responds with a PasswordPolicyResponse control response, which
causes the pam_authenticate function to return a success code even if
authentication has failed, as originally reported for xscreensaver.
This might lead to an attacker being able to login into a suspended
system account.
Updated packages have been patched to correct this issue.
| Updated Packages |
Mandriva Linux 2006
88544f487e0884831e8dca48d9420eca 2006.0/i586/pam_ldap-180-2.1.20060mdk.i586.rpm 2873ac0db22512131ad2f4a5d055e035 2006.0/SRPMS/pam_ldap-180-2.1.20060mdk.src.rpm
Mandriva Linux 2006/X86_64
4cdb139a35c0b877fccb62b344292133 2006.0/x86_64/pam_ldap-180-2.1.20060mdk.x86_64.rpm 2873ac0db22512131ad2f4a5d055e035 2006.0/SRPMS/pam_ldap-180-2.1.20060mdk.src.rpm
Mandriva Linux 2007
338ecc4e0b69209b99f9ad317d6d2385 2007.0/i586/pam_ldap-180-4.1mdv2007.0.i586.rpm 3a747dcc317e95fdc9011c1dfc4254ef 2007.0/SRPMS/pam_ldap-180-4.1mdv2007.0.src.rpm
Mandriva Linux 2007/X86_64
079964ab75deaa3a8d723bc63c4e9be7 2007.0/x86_64/pam_ldap-180-4.1mdv2007.0.x86_64.rpm 3a747dcc317e95fdc9011c1dfc4254ef 2007.0/SRPMS/pam_ldap-180-4.1mdv2007.0.src.rpm
Corporate Server 4.0
8e800885b38df7d3b566cea4934cdb24 corporate/4.0/i586/pam_ldap-180-3.1.20060mlcs4.i586.rpm 4abf9cd7b032153e407cf487968bc10a corporate/4.0/SRPMS/pam_ldap-180-3.1.20060mlcs4.src.rpm
Corporate Server 4.0/X86_64
92a60cc8a2d16e7cb305a7665e39e696 corporate/4.0/x86_64/pam_ldap-180-3.1.20060mlcs4.x86_64.rpm 4abf9cd7b032153e407cf487968bc10a corporate/4.0/SRPMS/pam_ldap-180-3.1.20060mlcs4.src.rpm
| References |
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-5170
| Upgrade |
To upgrade automatically, use MandrivaUpdate.
| Verification |
Please verify the update prior to upgrading to ensure the integrity of the downloaded package. You can do this with the command :
rpm --checksig package.rpm
You can get the GPG public key of the Mandriva Security Team to verify the GPG signature of each RPM.
If you use MandrivaUpdate, the verification of md5 checksum and GPG signature is performed automatically for you.