Alerts This Week
Warning Icon 1 485
Alerts This Week
Warning Icon 1 485

Red Hat: RHSA-2008:0780-01 Low: Coreutils Authentication Issue

red hat
Calendar Grey July 24, 2008
Dist Redhat Esm H88
A security patch for Coreutils in Red Hat Enterprise Linux addresses minor authentication vulnerabilities, rated as low in impact.
Updated coreutils packages that fix a security issue are now available for Red Hat Enterprise Linux 4. This update has been rated as having low security impact by the Red Hat Se...

Solution

Before applying this update, make sure that all previously-released errata relevant to your system have been applied.

This update is available via Red Hat Network. Details on how to use the Red Hat Network to apply this update are available at

Summary

The coreutils package contains the core GNU utilities. It is the combination of the old GNU fileutils, sh-utils, and textutils packages.
The coreutils packages were found to not use the pam_succeed_if Pluggable Authentication Module (PAM) correctly in the configuration file for the "su" command. Any local user could use this command to change to a locked or expired user account if the target account's password was known to the user running "su". These updated packages, correctly, only allow the root user to switch to locked or expired accounts using "su". (CVE-2008-1946)
All users of coreutils are advised to upgrade to this updated package, which resolve this issue.

Topics%20covered

Topics Covered

security advisory Red Hat authentication issue coreutils low severity

References

https://www.cve.org/CVERecord?id=CVE-2008-1946 https://access.redhat.com/security/updates/classification#low

Package List

Red Hat Enterprise Linux AS version 4:
Source:
i386: coreutils-5.2.1-31.8.el4.i386.rpm coreutils-debuginfo-5.2.1-31.8.el4.i386.rpm
ia64: coreutils-5.2.1-31.8.el4.ia64.rpm coreutils-debuginfo-5.2.1-31.8.el4.ia64.rpm
ppc: coreutils-5.2.1-31.8.el4.ppc.rpm coreutils-debuginfo-5.2.1-31.8.el4.ppc.rpm
s390: coreutils-5.2.1-31.8.el4.s390.rpm coreutils-debuginfo-5.2.1-31.8.el4.s390.rpm
s390x: coreutils-5.2.1-31.8.el4.s390x.rpm coreutils-debuginfo-5.2.1-31.8.el4.s390x.rpm
x86_64: coreutils-5.2.1-31.8.el4.x86_64.rpm coreutils-debuginfo-5.2.1-31.8.el4.x86_64.rpm
Red Hat Enterprise Linux Desktop version 4:
Source:
i386: coreutils-5.2.1-31.8.el4.i386.rpm coreutils-debuginfo-5.2.1-31.8.el4.i386.rpm
x86_64: coreutils-5.2.1-31.8.el4.x86_64.rpm coreutils-debuginfo-5.2.1-31.8.el4.x86_64.rpm
Red Hat Enterprise Linux ES version 4:
Source:
i386: coreutils-5.2.1-31.8.el4.i386.rpm coreutils-debuginfo-5.2.1-31.8.el4.i386.rpm
ia64: coreutils-5.2.1-31.8.el4.ia64.rpm coreutils-debuginfo-5.2.1-31.8.el4.ia64.rpm
x86_64: coreutils-5.2.1-31.8.el4.x86_64.rpm coreutils-debuginfo-5.2.1-31.8.el4.x86_64.rpm
Red Hat Enterprise Linux WS version 4:
Source:
i386: coreutils-5.2.1-31.8.el4.i386.rpm coreutils-debuginfo-5.2.1-31.8.el4.i386.rpm


Read the Full Advisory


Severity
low
Lowest
Low
Medium
High
Critical

Advisory ID: RHSA-2008:0780-01
Product: Red Hat Enterprise Linux
Advisory URL: https://access.redhat.com/errata/RHSA-2008:0780.html
Issue date: 2008-07-24

Topic

Updated coreutils packages that fix a security issue are now available for Red Hat Enterprise Linux 4.

This update has been rated as having low security impact by the Red Hat Security Response Team.

Topics%20covered

Topics Covered

security advisory Red Hat authentication issue coreutils low severity

Relevant Releases Architectures

Red Hat Enterprise Linux AS version 4 - i386, ia64, ppc, s390, s390x, x86_64

Red Hat Enterprise Linux Desktop version 4 - i386, x86_64

Red Hat Enterprise Linux ES version 4 - i386, ia64, x86_64

Red Hat Enterprise Linux WS version 4 - i386, ia64, x86_64

Bugs Fixed

446488 - CVE-2008-1946 /etc/pam.d/su is wrong in RHEL-4.6

Get the latest News and Insights

Get the latest Linux and open source security news straight to your inbox.

Your message here