|
|
| Problem Description |
Marcus Meissner discovered that pppd's winbind plugin did not check for
the result of the setuid() call which could allow an attacker to
exploit this on systems with certain PAM limits enabled to execute the
NTLM authentication helper as root. This could possibly lead to
privilege escalation dependant upon the local winbind configuration.
Updated packages have been patched ot correct this issue.
| Updated Packages |
Mandriva Linux 2006
75455046d94e92441bbe2e0e2b773082 2006.0/RPMS/ppp-2.4.3-9.1.20060mdk.i586.rpm f567cca02725deb575a8f13452234664 2006.0/RPMS/ppp-devel-2.4.3-9.1.20060mdk.i586.rpm 8872f55ecea3ba6e001c4bca4972199e 2006.0/RPMS/ppp-dhcp-2.4.3-9.1.20060mdk.i586.rpm a741c885635d908b200a1bf60232b71f 2006.0/RPMS/ppp-pppoatm-2.4.3-9.1.20060mdk.i586.rpm 058a637fd471f0a4f2791fbbfe2f763b 2006.0/RPMS/ppp-pppoe-2.4.3-9.1.20060mdk.i586.rpm 3e0a3e901f9cab4fa879fec18fb6ac92 2006.0/RPMS/ppp-prompt-2.4.3-9.1.20060mdk.i586.rpm b2ed30cae68e544fc63c794742577f1a 2006.0/RPMS/ppp-radius-2.4.3-9.1.20060mdk.i586.rpm 2578865b6af5300d3027aa62eaa1466b 2006.0/SRPMS/ppp-2.4.3-9.1.20060mdk.src.rpm
Mandriva Linux 2006/X86_64
b00f91f85a11f75dfb3a038a15fee3e5 x86_64/2006.0/RPMS/ppp-2.4.3-9.1.20060mdk.x86_64.rpm 63c00cf07b9b2729e4820fb270372800 x86_64/2006.0/RPMS/ppp-devel-2.4.3-9.1.20060mdk.x86_64.rpm 90fe962badb7773bc747b2a595c42e2e x86_64/2006.0/RPMS/ppp-dhcp-2.4.3-9.1.20060mdk.x86_64.rpm 24074e562bef8364308931f71cd66644 x86_64/2006.0/RPMS/ppp-pppoatm-2.4.3-9.1.20060mdk.x86_64.rpm cf3ec260bf90e2b086fa02d4267bc5c2 x86_64/2006.0/RPMS/ppp-pppoe-2.4.3-9.1.20060mdk.x86_64.rpm 5455b8bd4daf610893ff36031ead5167 x86_64/2006.0/RPMS/ppp-prompt-2.4.3-9.1.20060mdk.x86_64.rpm 2dcb7f91af4fddeec7b83b396cd4d7f0 x86_64/2006.0/RPMS/ppp-radius-2.4.3-9.1.20060mdk.x86_64.rpm 2578865b6af5300d3027aa62eaa1466b x86_64/2006.0/SRPMS/ppp-2.4.3-9.1.20060mdk.src.rpm
| References |
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-2194
| Upgrade |
To upgrade automatically, use MandrivaUpdate.
| Verification |
Please verify the update prior to upgrading to ensure the integrity of the downloaded package. You can do this with the command :
rpm --checksig package.rpm
You can get the GPG public key of the Mandriva Security Team to verify the GPG signature of each RPM.
If you use MandrivaUpdate, the verification of md5 checksum and GPG signature is performed automatically for you.