Red Hat: RHSA-2008:0193-02 Critical: Privilege Gain Exploit

The lspp-eal4-config-ibm and capp-lspp-eal4-config-hp packages contain utilities and documentation for configuring a machine for the Controlled Access Protection Profile, or the Labeled Security Protection Profile.
It was discovered that use of the "capp-lspp-config" script results in the "/etc/pam.d/system-auth" file being set to world-writable. Authorized local users who have limited privileges could then exploit this to gain additional access, or to escalate their privileges. (CVE-2008-0884)
This issue only affects users who have installed either of these packages from the Red Hat FTP site as their base system configuration kickstart script.
New deployments using the lspp-eal4-config-ibm or capp-lspp-eal4-config-hp packages are advised to upgrade to these updated packages, which resolve this issue.
For systems already deployed, the following command can be run as root to restore the permissions to a secure setting:
chmod 0644 /etc/pam.d/system-auth