diff options
| author | Yue Tao <Yue.Tao@windriver.com> | 2014-06-17 04:23:59 -0400 |
|---|---|---|
| committer | Richard Purdie <richard.purdie@linuxfoundation.org> | 2014-06-17 10:23:45 +0100 |
| commit | 69255c84ebd99629da8174e1e73fd8c715e49b52 (patch) | |
| tree | f04acbee47192c163f1fb7e3f50ad1c35ebfa2c4 /meta/recipes-extended/pam/libpam_1.1.6.bb | |
| parent | bbeb133234fb90b01c9448afdecf03ebff7f7c47 (diff) | |
| download | openembedded-core-69255c84ebd99629da8174e1e73fd8c715e49b52.tar.gz openembedded-core-69255c84ebd99629da8174e1e73fd8c715e49b52.tar.bz2 openembedded-core-69255c84ebd99629da8174e1e73fd8c715e49b52.zip | |
libpam: Security Advisory - CVE-2014-2583
v2 changes:
* update format for commit log
* add Upstream-Status for patch
Multiple directory traversal vulnerabilities in pam_timestamp.c in the
pam_timestamp module for Linux-PAM (aka pam) 1.1.8 allow local users to
create aribitrary files or possibly bypass authentication via a .. (dot
dot) in the (1) PAM_RUSER value to the get_ruser function or (2) PAM_TTY
value to the check_tty funtion, which is used by the
format_timestamp_name function.
http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2014-2583
Signed-off-by: Yue Tao <Yue.Tao@windriver.com>
Signed-off-by: Wenzong Fan <wenzong.fan@windriver.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Diffstat (limited to 'meta/recipes-extended/pam/libpam_1.1.6.bb')
| -rw-r--r-- | meta/recipes-extended/pam/libpam_1.1.6.bb | 1 |
1 files changed, 1 insertions, 0 deletions
diff --git a/meta/recipes-extended/pam/libpam_1.1.6.bb b/meta/recipes-extended/pam/libpam_1.1.6.bb index 7e55adfb04..3190aaf0d1 100644 --- a/meta/recipes-extended/pam/libpam_1.1.6.bb +++ b/meta/recipes-extended/pam/libpam_1.1.6.bb @@ -25,6 +25,7 @@ SRC_URI = "http://linux-pam.org/library/Linux-PAM-${PV}.tar.bz2 \ file://libpam-fix-for-CVE-2010-4708.patch \ file://pam-security-abstract-securetty-handling.patch \ file://pam-unix-nullok-secure.patch \ + file://pam_timestamp-fix-potential-directory-traversal-issu.patch \ " SRC_URI[md5sum] = "7b73e58b7ce79ffa321d408de06db2c4" SRC_URI[sha256sum] = "bab887d6280f47fc3963df3b95735a27a16f0f663636163ddf3acab5f1149fc2" |