pam-1.3.1-36.el8_10
エラータID: AXSA:2024-9040:04
リリース日:
2024/11/29 Friday - 14:13
題名:
pam-1.3.1-36.el8_10
影響のあるチャネル:
Asianux Server 8 for x86_64
Severity:
High
Description:
以下項目について対処しました。
[Security Fix]
- PAM には、標準入力への文字の送信によって不正なプログラム
を実行させ、結果として ROP チェーンに対するサイドチャネル
攻撃を許容してしまう問題があるため、ローカルの攻撃者により、
標準入力への細工された入力の処理を介して、パスワードの漏洩
を可能とする脆弱性が存在します。(CVE-2024-10041)
- pam_access モジュールには、access.conf ファイルに設定
されたトークンを誤ってホスト名として解釈してしまう問題が
あるため、リモートの攻撃者により、細工された access.conf
ファイルの処理を介して、特定の TTY およびサービスへの
アクセス制限の迂回を可能とする脆弱性が存在します。
(CVE-2024-10963)
解決策:
パッケージをアップデートしてください。
CVE:
CVE-2024-10041
A vulnerability was found in PAM. The secret information is stored in memory, where the attacker can trigger the victim program to execute by sending characters to its standard input (stdin). As this occurs, the attacker can train the branch predictor to execute an ROP chain speculatively. This flaw could result in leaked passwords, such as those found in /etc/shadow while performing authentications.
A vulnerability was found in PAM. The secret information is stored in memory, where the attacker can trigger the victim program to execute by sending characters to its standard input (stdin). As this occurs, the attacker can train the branch predictor to execute an ROP chain speculatively. This flaw could result in leaked passwords, such as those found in /etc/shadow while performing authentications.
CVE-2024-10963
A flaw was found in pam_access, where certain rules in its configuration file are mistakenly treated as hostnames. This vulnerability allows attackers to trick the system by pretending to be a trusted hostname, gaining unauthorized access. This issue poses a risk for systems that rely on this feature to control who can access certain services or terminals.
A flaw was found in pam_access, where certain rules in its configuration file are mistakenly treated as hostnames. This vulnerability allows attackers to trick the system by pretending to be a trusted hostname, gaining unauthorized access. This issue poses a risk for systems that rely on this feature to control who can access certain services or terminals.
追加情報:
N/A
ダウンロード:
SRPMS
- pam-1.3.1-36.el8_10.src.rpm
MD5: bfd5bfd0fdaeaeff780f1edaea0a8cec
SHA-256: 6dbed15f8a89793e50bb8f89f575a393db7dcdb4730ba2d69c5b9b44df92ca55
Size: 1.11 MB
Asianux Server 8 for x86_64
- pam-1.3.1-36.el8_10.i686.rpm
MD5: 0e1a2c9db5ed65e6ffe62cca52277db7
SHA-256: 3599a0466547ef412ffe04742dca2aeddfa6d3dbc493a31d42c416dcb9380d8b
Size: 766.93 kB - pam-1.3.1-36.el8_10.x86_64.rpm
MD5: 98e0764411679b7ce29e9cdb316e6bfd
SHA-256: 3871d32df32b7a51ca6a30dc0510577a9642ef03b299bf789548c23767dab4bb
Size: 746.55 kB - pam-devel-1.3.1-36.el8_10.i686.rpm
MD5: 910ffc2c2f02d97ea758699ede1af6ae
SHA-256: c5b8a2d031298d4248fe3db9b009ce86462026c1f8b41f9c52b2701ae75efb55
Size: 211.21 kB - pam-devel-1.3.1-36.el8_10.x86_64.rpm
MD5: a7e01fd6d58ac746bae42ef7792db305
SHA-256: ac5e499109c613583e4eff14154e8d8c69ae6cb3ad56532c6fa8937733daa051
Size: 211.21 kB
English