GLSA 200404-06: Util-linux login may leak sensitive data

http://security.gentoo.org/

Severity:	low
Title:	Util-linux login may leak sensitive data
Date:	04/07/2004
Bugs:	#46422
ID:	200404-06

Synopsis

The login program included in util-linux could leak sensitive information under certain conditions.

Background

Util-linux is a suite of essential system utilites, including login, agetty, fdisk.

Affected packages

Package	Vulnerable	Unaffected	Architecture(s)
sys-apps/util-linux	<= 2.11	>= 2.12	All supported architectures

Description

In some situations the login program could leak sensitive data due to an incorrect usage of a reallocated pointer.

NOTE: Only users who have PAM support disabled on their systems (i.e. -PAM in their USE variable) will be affected by this vulnerability. By default, this USE flag is enabled on all architectures. Users with PAM support on their system receive login binaries as part of the pam-login package, which remains unaffected.

Impact

A remote attacker may obtain sensitive data.

Workaround

A workaround is not currently known for this issue. All users are advised to upgrade to the latest version of the affected package.

Resolution

All util-linux users should upgrade to version 2.12 or later:

    # emerge sync
    
	# emerge -pv ">=sys-apps/util-linux-2.12"
    # emerge ">=sys-apps/util-linux-2.12"

References

CAN-2004-0080

Availability

This GLSA and any updates to it are available for viewing at the Gentoo Security Website: http://security.gentoo.org/glsa/glsa-200404-06.xml

Concerns?

Security is a primary focus of Gentoo Linux and ensuring the confidentiality and security of our users machines is of utmost importance to us. Any security concerns should be addressed to security@gentoo.org or alternatively, you may file a bug at https://bugs.gentoo.org.