Util-linux Login Security Bypass Vulnerability
TITLE: Util-linux Login Security Bypass Vulnerability
CLASS: Access Validation Error
CVE: CVE-2006-7108
REMOTE: Yes
LOCAL: No
PUBLISHED: Jun 05 2007 12:00AM
UPDATE: Jun 15 2007 06:50PM
CREDIT: Craig Lawson is credited with the discovery of this vulnerability.
VULNERABLE:
util-linux util-linux 2.12 aNOT VULNERABLE:
util-linux util-linux 2.12
util-linux util-linux 2.11 z
util-linux util-linux 2.11 u
util-linux util-linux 2.11 r
util-linux util-linux 2.11 n
util-linux util-linux 2.11
util-linux util-linux 2.10
util-linux util-linux 2.9
util-linux util-linux 2.8
rPath rPath Linux 1
RedHat Enterprise Linux WS 4
RedHat Enterprise Linux ES 4
RedHat Enterprise Linux AS 4
RedHat Desktop 4.0
MandrakeSoft Linux Mandrake 2007.1 x86_64
MandrakeSoft Linux Mandrake 2007.1
MandrakeSoft Linux Mandrake 2007.0 x86_64
MandrakeSoft Linux Mandrake 2007.0
MandrakeSoft Corporate Server 4.0 x86_64
MandrakeSoft Corporate Server 3.0 x86_64
MandrakeSoft Corporate Server 3.0
MandrakeSoft Corporate Server 4.0
util-linux util-linux 2.13 -pre3
util-linux util-linux 2.13 -pre2
util-linux util-linux 2.13 -pre1
util-linux util-linux 2.12 r-pre1
util-linux util-linux 2.12 r
util-linux util-linux 2.12 q
util-linux util-linux 2.12 p
util-linux util-linux 2.12 b
Vai alla pagina originale su Security Focus
Discussion
The 'login' utility (in 'util-linux') is prone to a security-bypass vulnerability because the utility fails to properly validate user privileges.
Exploiting this issue can allow an attacker to bypass certain security restrictions and potentially gain unauthorized access.
Versions prior to 'util-linux' 2.12 are vulnerable.
Exploit
Currently we are not aware of any exploits for this issue. If you feel we are in error or if you are aware of more recent information, please mail us at: mailto:vuldb@securityfocus.com.
Solution
Solution:
Please see the referenced advisories for details on obtaining the appropriate updates.
References
References:
- Bugzilla Bug 177331: CVE-2006-7108 login omits pam_acct_mgmt & pam_chauthtok whe (RedHat)
- RHSA-2007:0235-2 - util-linux security and bug fix update (RedHat)
- util-linux Home Page (util-linux)