Mageia alert MGASA-2015-0352 (util-linux)

From:
    	     
 
Mageia Updates <buildsystem-daemon@mageia.org> 
To:
    	     
 
updates-announce@ml.mageia.org 
Subject:
    	     
 
[updates-announce] MGASA-2015-0352: Updated util-linux packages fix CVE-2015-5224 
Date:
    	     
 
Tue, 8 Sep 2015 19:56:43 +0200
Message-ID:
    	     
 
<20150908175643.7C09A48CD1@valstar.mageia.org>
MGASA-2015-0352 - Updated util-linux packages fix CVE-2015-5224

Publication date: 08 Sep 2015
URL: http://advisories.mageia.org/MGASA-2015-0352.html
Type: security
Affected Mageia releases: 5
CVE: CVE-2015-5224

Description:
Updated util-linux packages fix security vulnerability:

The chfn and chsh commands in util-linux's login-utils are vulnerable to a
file name collision due to incorrect mkstemp usage. If the chfn and chsh
binaries are both setuid-root they eventually call mkostemp in such a way that
an attacker could repeatedly call them and eventually be able to overwrite
certain files in /etc (CVE-2015-5224).

References:
- https://bugs.mageia.org/show_bug.cgi?id=16641
- http://openwall.com/lists/oss-security/2015/08/24/3
- http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-5224

SRPMS:
- 5/core/util-linux-2.25.2-3.1.mga5