-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 _______________________________________________________________________ Mandriva Linux Security Advisory MDVSA-2011:019 http://www.mandriva.com/security/ _______________________________________________________________________ Package : libuser Date : January 26, 2011 Affected: 2009.0, 2010.0, 2010.1, Corporate 4.0, Enterprise Server 5.0 _______________________________________________________________________ Problem Description: A vulnerability has been found and corrected in libuser: libuser before 0.57 uses a cleartext password value of (1) !! or (2) x for new LDAP user accounts, which makes it easier for remote attackers to obtain access by specifying one of these values (CVE-2011-0002). Packages for 2009.0 are provided as of the Extended Maintenance Program. Please visit this link to learn more: http://store.mandriva.com/product_info.php?cPath=149&products_id=490 The updated packages have been patched to correct this issue. _______________________________________________________________________ References: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-0002 _______________________________________________________________________ Updated Packages: Mandriva Linux 2009.0: ca70c36b0b0d92777fd018d6f3cdd6e2 2009.0/i586/libuser-0.56.9-2.1mdv2009.0.i586.rpm 43123c3c58d55604307834fd7ada929c 2009.0/i586/libuser1-0.56.9-2.1mdv2009.0.i586.rpm f3cfd126ba0c48a73462950fc50588de 2009.0/i586/libuser-devel-0.56.9-2.1mdv2009.0.i586.rpm fa5bb059a1d0dd7d58b1d7057e5c0f7f 2009.0/i586/libuser-ldap-0.56.9-2.1mdv2009.0.i586.rpm 508e8b5bb1fd7e40f078842198f0f7e3 2009.0/i586/libuser-python-0.56.9-2.1mdv2009.0.i586.rpm 6195ca448d84b938fe21d1f2edf1378f 2009.0/SRPMS/libuser-0.56.9-2.1mdv2009.0.src.rpm Mandriva Linux 2009.0/X86_64: 7c97f6e1a82f6674873388e6c2ccb235 2009.0/x86_64/lib64user1-0.56.9-2.1mdv2009.0.x86_64.rpm 37abe1149c3e6e602cfd1e9621e03e82 2009.0/x86_64/lib64user-devel-0.56.9-2.1mdv2009.0.x86_64.rpm 5e46fc7dd4d31d6a05f221b14899109c 2009.0/x86_64/libuser-0.56.9-2.1mdv2009.0.x86_64.rpm 8a5e9ae3b52cca038070b411eb38b870 2009.0/x86_64/libuser-ldap-0.56.9-2.1mdv2009.0.x86_64.rpm f42063e6d27cad1685d9b66021e8328e 2009.0/x86_64/libuser-python-0.56.9-2.1mdv2009.0.x86_64.rpm 6195ca448d84b938fe21d1f2edf1378f 2009.0/SRPMS/libuser-0.56.9-2.1mdv2009.0.src.rpm Mandriva Linux 2010.0: 1390c942454ebf498ce5567283850e7e 2010.0/i586/libuser-0.56.11-1.1mdv2010.0.i586.rpm 054618569e80a6e1767d5e6529399d23 2010.0/i586/libuser1-0.56.11-1.1mdv2010.0.i586.rpm 1190320b655c4187f7fded7db74faed3 2010.0/i586/libuser-devel-0.56.11-1.1mdv2010.0.i586.rpm ba9f0a4af374c840a953de2ac46c80fb 2010.0/i586/libuser-ldap-0.56.11-1.1mdv2010.0.i586.rpm 41cc3b8d5a823e4a704cfb282fa9c76a 2010.0/i586/libuser-python-0.56.11-1.1mdv2010.0.i586.rpm 2694df315cb32a260064d024722beec9 2010.0/SRPMS/libuser-0.56.11-1.1mdv2010.0.src.rpm Mandriva Linux 2010.0/X86_64: 85d05e42080e8ad098261b7f10626f1a 2010.0/x86_64/lib64user1-0.56.11-1.1mdv2010.0.x86_64.rpm e2f2f311c3e00680b68f40e5189f4b3f 2010.0/x86_64/lib64user-devel-0.56.11-1.1mdv2010.0.x86_64.rpm 491f4e0c92f99e68ab2ba60dd969e10d 2010.0/x86_64/libuser-0.56.11-1.1mdv2010.0.x86_64.rpm f63768ddb727e3bf9b201756747e4f5e 2010.0/x86_64/libuser-ldap-0.56.11-1.1mdv2010.0.x86_64.rpm 74fa01df91da0fd1b9d37a7bcd91116d 2010.0/x86_64/libuser-python-0.56.11-1.1mdv2010.0.x86_64.rpm 2694df315cb32a260064d024722beec9 2010.0/SRPMS/libuser-0.56.11-1.1mdv2010.0.src.rpm Mandriva Linux 2010.1: 5c942ad8edeaea55a2091479838f602f 2010.1/i586/libuser-0.56.15-3.1mdv2010.2.i586.rpm 6f3c60d4bdc1acb67a5ac4e4593c7610 2010.1/i586/libuser1-0.56.15-3.1mdv2010.2.i586.rpm 191f919d23e87ed4108691778c34f082 2010.1/i586/libuser-devel-0.56.15-3.1mdv2010.2.i586.rpm b89cb7b101b523807d5b78aba657a724 2010.1/i586/libuser-ldap-0.56.15-3.1mdv2010.2.i586.rpm 1d6e2b68af335fc1ad493d96854d3df9 2010.1/i586/libuser-python-0.56.15-3.1mdv2010.2.i586.rpm 9e651f9eeb0978d060ad26e254c11b64 2010.1/SRPMS/libuser-0.56.15-3.1mdv2010.2.src.rpm Mandriva Linux 2010.1/X86_64: 45205a3cf4cf90c8fc45bfb5b3f544ed 2010.1/x86_64/lib64user1-0.56.15-3.1mdv2010.2.x86_64.rpm b90aab76a88221ed42dfa51272294d91 2010.1/x86_64/lib64user-devel-0.56.15-3.1mdv2010.2.x86_64.rpm 8c1dbfacfe98699d30d1b6c3e83b966e 2010.1/x86_64/libuser-0.56.15-3.1mdv2010.2.x86_64.rpm 68294d567786b431654d1b7ec0850214 2010.1/x86_64/libuser-ldap-0.56.15-3.1mdv2010.2.x86_64.rpm 1b12f17a64c7df7840fbd81f8657c979 2010.1/x86_64/libuser-python-0.56.15-3.1mdv2010.2.x86_64.rpm 9e651f9eeb0978d060ad26e254c11b64 2010.1/SRPMS/libuser-0.56.15-3.1mdv2010.2.src.rpm Corporate 4.0: 9070225e84b5ec4c97728927d58b9434 corporate/4.0/i586/libuser-0.53.2-6.1.20060mlcs4.i586.rpm 3fca7372f85b38bfb55a9e1e10c75ec0 corporate/4.0/i586/libuser1-0.53.2-6.1.20060mlcs4.i586.rpm 7ffeb054b227ea45e44bacbcd7438a53 corporate/4.0/i586/libuser1-devel-0.53.2-6.1.20060mlcs4.i586.rpm 5024fc1f8f479523de5df0123e11fe89 corporate/4.0/i586/libuser-ldap-0.53.2-6.1.20060mlcs4.i586.rpm 30d7fa230a2f47e325ea375e70752e19 corporate/4.0/i586/libuser-python-0.53.2-6.1.20060mlcs4.i586.rpm f1682ded4b626754df6cc6473188a67a corporate/4.0/SRPMS/libuser-0.53.2-6.1.20060mlcs4.src.rpm Corporate 4.0/X86_64: c0b394abc4fa5166486f04144d2608bb corporate/4.0/x86_64/lib64user1-0.53.2-6.1.20060mlcs4.x86_64.rpm 88a8eeeebf4ab9858a92a49cc64ea473 corporate/4.0/x86_64/lib64user1-devel-0.53.2-6.1.20060mlcs4.x86_64.rpm 338cc3bd6928f941e500894a0f4fd2ec corporate/4.0/x86_64/libuser-0.53.2-6.1.20060mlcs4.x86_64.rpm 277e2f281f1bdc3d7eab6df61353622d corporate/4.0/x86_64/libuser-ldap-0.53.2-6.1.20060mlcs4.x86_64.rpm f2f6ee658734f4b99c6c2aca5f6555ec corporate/4.0/x86_64/libuser-python-0.53.2-6.1.20060mlcs4.x86_64.rpm f1682ded4b626754df6cc6473188a67a corporate/4.0/SRPMS/libuser-0.53.2-6.1.20060mlcs4.src.rpm Mandriva Enterprise Server 5: 08fd1e0c14e5c86e418a23ad27401482 mes5/i586/libuser-0.56.9-2.1mdvmes5.1.i586.rpm 36eddbc333424b33c449b8d1c3befc7d mes5/i586/libuser1-0.56.9-2.1mdvmes5.1.i586.rpm 2279332ac99a92a8887466261723fc35 mes5/i586/libuser-devel-0.56.9-2.1mdvmes5.1.i586.rpm 1e86f7af7fa2319faa4b4325ecf50af1 mes5/i586/libuser-ldap-0.56.9-2.1mdvmes5.1.i586.rpm c8797fd70e4bac0fad491dbc637c1bed mes5/i586/libuser-python-0.56.9-2.1mdvmes5.1.i586.rpm 4737264ba1e04fd2113929a3a870bc7a mes5/SRPMS/libuser-0.56.9-2.1mdvmes5.1.src.rpm Mandriva Enterprise Server 5/X86_64: e4b5455914906b5e4a02f4e0bcc2cf84 mes5/x86_64/lib64user1-0.56.9-2.1mdvmes5.1.x86_64.rpm 6c48c50ddcac7db31866e4f0564c8b02 mes5/x86_64/lib64user-devel-0.56.9-2.1mdvmes5.1.x86_64.rpm 1bde510f65afa24f88a736fd6ce80792 mes5/x86_64/libuser-0.56.9-2.1mdvmes5.1.x86_64.rpm 2599076762dd6552b0d873fa883b3256 mes5/x86_64/libuser-ldap-0.56.9-2.1mdvmes5.1.x86_64.rpm 52f2f33b577bbac0be8fdcbb8548a627 mes5/x86_64/libuser-python-0.56.9-2.1mdvmes5.1.x86_64.rpm 4737264ba1e04fd2113929a3a870bc7a mes5/SRPMS/libuser-0.56.9-2.1mdvmes5.1.src.rpm _______________________________________________________________________ To upgrade automatically use MandrivaUpdate or urpmi. The verification of md5 checksums and GPG signatures is performed automatically for you. All packages are signed by Mandriva for security. You can obtain the GPG public key of the Mandriva Security Team by executing: gpg --recv-keys --keyserver pgp.mit.edu 0x22458A98 You can view other update advisories for Mandriva Linux at: http://www.mandriva.com/security/advisories If you want to report vulnerabilities, please contact security_(at)_mandriva.com _______________________________________________________________________ Type Bits/KeyID Date User ID pub 1024D/22458A98 2000-07-10 Mandriva Security Team -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.9 (GNU/Linux) iD8DBQFNQCRpmqjQ0CJFipgRAlCPAKCnhM95ruMCqhmlagQtf74j8JZF7ACfcIaO oWiDxxTET0vgcarHfwgKBAs= =q2du -----END PGP SIGNATURE----- _______________________________________________ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/