Mandrake passwd PAM md5 Support Lacking Vulnerability

Bugtraq ID:	3683
Class:	Configuration Error
CVE:	CVE-2001-1190
Remote:	No
Local:	Yes
Published:	Dec 12 2001 12:00AM
Updated:	Jul 11 2009 09:06AM
Credit:	Published in Mandrake Security Advisory MDSKA-2001:091, dated December 12, 2001.
Vulnerable:	Mandriva Linux Mandrake 8.1
Not Vulnerable:

Mandrake passwd PAM md5 Support Lacking Vulnerability

passwd is a Unix utility used to change a user's password. PAM is a modular system for implementing various authentication methods, and is used by passwd in current Mandrake Linux distributions.

In some distributions of Mandrake, the pam files used by passwd do not include support for md5 encryption. After the installation process is complete, any password changes or new accounts created will not have md5 encrypted passwords. This may result in lower security than anticipated.

Mandrake passwd PAM md5 Support Lacking Vulnerability

No exploit code is required to take advantage of this issue.

Mandrake passwd PAM md5 Support Lacking Vulnerability

Solution:
Patches are available.


Mandriva Linux Mandrake 8.1

• Mandrake 8.1 i586 passwd-0.64.1-9.1mdk.i586.rpm
  http://www.linux-mandrake.com/en/ftp.php3


• Mandrake 8.1 ia64 passwd-0.64.1-9.1mdk.ia64.rpm
  http://www.linux-mandrake.com/en/ftp.php3

Mandrake passwd PAM md5 Support Lacking Vulnerability

References: