ID de Prueba:	1.3.6.1.4.1.25623.1.0.63648
Categoría:	Mandrake Local Security Checks
Título:	Mandrake Security Advisory MDVSA-2009:077 (pam)
Resumen:	The remote host is missing an update to pam;announced via advisory MDVSA-2009:077.
Descripción:	Summary: The remote host is missing an update to pam announced via advisory MDVSA-2009:077. Vulnerability Insight: A security vulnerability has been identified and fixed in pam: Integer signedness error in the _pam_StrTok function in libpam/pam_misc.c in Linux-PAM (aka pam) 1.0.3 and earlier, when a configuration file contains non-ASCII usernames, might allow remote attackers to cause a denial of service, and might allow remote authenticated users to obtain login access with a different user's non-ASCII username, via a login attempt (CVE-2009-0887). The updated packages have been patched to prevent this. Additionally some development packages were missing that are required to build pam for CS4, these are also provided with this update. Affected: 2008.0, 2008.1, 2009.0, Corporate 3.0, Corporate 4.0, Multi Network Firewall 2.0 Solution: To upgrade automatically use MandrakeUpdate or urpmi. The verification of md5 checksums and GPG signatures is performed automatically for you. CVSS Score: 6.6 CVSS Vector: AV:L/AC:M/Au:S/C:C/I:C/A:C
Referencia Cruzada:	Common Vulnerability Exposure (CVE) ID: CVE-2009-0887 BugTraq ID: 34010 http://www.securityfocus.com/bid/34010 https://www.redhat.com/archives/fedora-package-announce/2009-April/msg00398.html https://www.redhat.com/archives/fedora-package-announce/2009-April/msg00420.html http://www.mandriva.com/security/advisories?name=MDVSA-2009:077 http://openwall.com/lists/oss-security/2009/03/05/1 http://secunia.com/advisories/34733 XForce ISS Database: linuxpam-pamstrtok-priv-escalation(49110) https://exchange.xforce.ibmcloud.com/vulnerabilities/49110
Copyright	Copyright (C) 2009 E-Soft Inc.

Esta es sólo una de 146377 pruebas de vulnerabilidad en nuestra serie de pruebas. Encuentre más sobre cómo ejecutar una auditoría de seguridad completa. Para ejecutar una prueba gratuita de esta vulnerabilidad contra su sistema, regístrese ahora.