[linux-security] util-linux login vulnerability

[Martin Siegert <siegert@sfu.ca>]

Topic
=====
The login program from the util-linux package can be used to gain other
user's credentials.

Problem Description
===================
The "login" program in util-linux stored the user's credentials in a
static buffer that could later be reused in other PAM calls issued on
behalf of other users.  This could lead to a user gaining access to
other accounts.
Note that on most distributions this is not possible by default.

Affected Systems
================
Systems that use the util-linux package with versions < 2.11l and
use pam_limits.so in /etc/pam.d/login.

Solution
========
Upgrade to a patched version for your distribution (or compile
util-linux-2.11l from source)

RedHat 7.1
----------
rpm -Fvh util-linux-2.11f-11.7.1.i386.rpm

RedHat 7.2
----------
rpm -Fvh util-linux-2.11f-12.i386.rpm