Technical Description

A vulnerability has been identified in Mandriva, which could be exploited by malicious users to gain elevated privileges. This issue is caused by an error in pam_krb5. For additional information, see : VUPEN/ADV-2008-2720

Affected Products

Mandriva Linux 2007.1
Mandriva Linux 2008.0
Mandriva Linux 2008.1

Solution

Upgrade the affected packages :

Mandriva Linux 2007.1:
92901a92d669d10831a2357da8ac3ff8 2007.1/i586/pam_krb5-2.2.11-2.1mdv2007.1.i586.rpm
e8ba90e174669b8b43bf0bbf9c61831f 2007.1/SRPMS/pam_krb5-2.2.11-2.1mdv2007.1.src.rpm

Mandriva Linux 2007.1/X86_64:
63e366f352ed36d5e6b7b87a84d25d33 2007.1/x86_64/pam_krb5-2.2.11-2.1mdv2007.1.x86_64.rpm
e8ba90e174669b8b43bf0bbf9c61831f 2007.1/SRPMS/pam_krb5-2.2.11-2.1mdv2007.1.src.rpm

Mandriva Linux 2008.0:
d5d6796b990f19316ee7a53d87745d63 2008.0/i586/pam_krb5-2.2.11-2.1mdv2008.0.i586.rpm
8b2d51b298306d43dfde2fe6f9cb0860 2008.0/SRPMS/pam_krb5-2.2.11-2.1mdv2008.0.src.rpm

Mandriva Linux 2008.0/X86_64:
5cb8c3f5768cdc475bfa81e14244856b 2008.0/x86_64/pam_krb5-2.2.11-2.1mdv2008.0.x86_64.rpm
8b2d51b298306d43dfde2fe6f9cb0860 2008.0/SRPMS/pam_krb5-2.2.11-2.1mdv2008.0.src.rpm

Mandriva Linux 2008.1:
2d30041830c5c3db19a23e096a968426 2008.1/i586/pam_krb5-2.2.11-2.1mdv2008.1.i586.rpm
2d1f96e821e05ddba6ffe3d1cee2247b 2008.1/SRPMS/pam_krb5-2.2.11-2.1mdv2008.1.src.rpm

Mandriva Linux 2008.1/X86_64:
d07f560edf337af6279a888fd695aa49 2008.1/x86_64/pam_krb5-2.2.11-2.1mdv2008.1.x86_64.rpm
2d1f96e821e05ddba6ffe3d1cee2247b 2008.1/SRPMS/pam_krb5-2.2.11-2.1mdv2008.1.src.rpm

References

http://www.vupen.com/english/advisories/2008/2730
http://archives.mandrivalinux.com/security-announce/2008-10/msg00001.php

ChangeLog

2008-10-06 : Initial release

Vulnerability Management

Subscribe to VUPEN VNS and receive real-time e-mail and SMS alerts when new advisories or patches relevant to your systems and network configurations are available.

Feedback

If you have additional information or corrections for this security advisory please submit them via our contact form.