The USN-1140-1 PAM update caused cron to stop working.. =========================================================================Ubuntu Security Notice USN-1140-2 May 31, 2011 pam regression ========================================================================= A security issue affects these releases of Ubuntu and its derivatives: - Ubuntu 11.04 - Ubuntu 10.10 - Ubuntu 10.04 LTS - Ubuntu 8.04 LTS Summary: The USN-1140-1 PAM update caused cron to stop working. Software Description: - pam: Pluggable Authentication Modules Details: USN-1140-1 fixed vulnerabilities in PAM. A regression was found that caused cron to stop working with a "Module is unknown" error. As a result, systems configured with automatic updates will not receive updates until cron is restarted, these updates are installed or the system is rebooted. This update fixes the problem. We apologize for the inconvenience. Original advisory details: Marcus Granado discovered that PAM incorrectly handled configuration files with non-ASCII usernames. A remote attacker could use this flaw to cause a denial of service, or possibly obtain login access with a different users username. This issue only affected Ubuntu 8.04 LTS. (CVE-2009-0887) It was discovered that the PAM pam_xauth, pam_env and pam_mail modules incorrectly handled dropping privileges when performing operations. A local attacker could use this flaw to read certain arbitrary files, and access other sensitive information. (CVE-2010-3316, CVE-2010-3430, CVE-2010-3431, CVE-2010-3435) It was discovered that the PAM pam_namespace module incorrectly cleaned the environment during execution of the namespace.init script. A local attacker could use this flaw to possibly gain privileges. (CVE-2010-3853) It was discovered that the PAM pam_xauth module incorrectly handled certain failures. A local attacker could use this flaw to delete certain unintended files. (CVE-2010-4706) It was discovered that the PAM pam_xauthmodule incorrectly verified certain file properties. A local attacker could use this flaw to cause a denial of service. (CVE-2010-4707) Update instructions: The problem can be corrected by updating your system to the following package versions: Ubuntu 11.04: libpam-modules 1.1.2-2ubuntu8.3 libpam0g 1.1.2-2ubuntu8.3 Ubuntu 10.10: libpam-modules 1.1.1-4ubuntu2.3 libpam0g 1.1.1-4ubuntu2.3 Ubuntu 10.04 LTS: libpam-modules 1.1.1-2ubuntu5.3 libpam0g 1.1.1-2ubuntu5.3 Ubuntu 8.04 LTS: libpam-modules 0.99.7.1-5ubuntu6.4 libpam0g 0.99.7.1-5ubuntu6.4 In general, a standard system update will make all the necessary changes. References: https://bugs.launchpad.net/ubuntu/+source/pam/+bug/790538 Package Information: https://launchpad.net/ubuntu/+source/pam/1.1.2-2ubuntu8.3 https://launchpad.net/ubuntu/+source/pam/1.1.1-4ubuntu2.3 https://launchpad.net/ubuntu/+source/pam/1.1.1-2ubuntu5.3 https://launchpad.net/ubuntu/+source/pam/0.99.7.1-5ubuntu6.4 . Explore the regression issue related to PAM impacting cron services in Ubuntu, detailing affected versions and patch notes designed to enhance security measures. PAM Regression, Cron Functionality, Ubuntu Security Fix, Local Attack Mitigation. . LinuxSecurity.com Team
The following updated rpms for Enterprise Linux 3 have been uploaded to the Unbreakable Linux Network: . Enterprise Linux Security Advisory ELSA-2007-0345 https://access.redhat.com/errata/RHSA-2007:0345.html The following updated rpms for Enterprise Linux 3 have been uploaded to the Unbreakable Linux Network: i386: vixie-cron-4.1-19.EL3.i386.rpm x86_64: vixie-cron-4.1-19.EL3.x86_64.rpm SRPMS: https://oss.oracle.com:443/el3/SRPMS-updates/vixie-cron-4.1-19.EL3.src.rpm Description of changes: [4.1-19.EL3] - CVE 235880, new year 223662 - Resolves: 223662, 235880 [4.1-18.EL3] - CVE 235880 - Resolves: 235880 [4.1-17.EL3] - CVE 235880, new year 223662 - Resolves: 223662, 235880 [4.1-16.EL3] - RHBA2007:0122 - rhbz#223662 removed [4.1-15.EL3] - rhbz#223662, rebuilt [4.1-13.EL3] - crond failed "Days of week" after a few hours on 1st January - rhbz#223662 [4.1-12.EL3] - rhbz#190255 . Corporate Linux Security Update CLSU-2008-0456 outlines critical patches for your device with a medium threat rating.. Enterprise Linux, Security Advisory, RPM Update, Unbreakable Network, Cron Problem. . LinuxSecurity.com Team
Get the latest Linux and open source security news straight to your inbox.