Skip to navigation

Enhancement Advisory passwd enhancement update

Advisory: RHEA-2012:0328-1
Type: Product Enhancement Advisory
Severity: N/A
Issued on: 2012-02-22
Last updated on: 2012-02-22
Affected Products: Red Hat Enterprise Linux Desktop (v. 6)
Red Hat Enterprise Linux HPC Node (v. 6)
Red Hat Enterprise Linux Server (v. 6)
Red Hat Enterprise Linux Server AUS (v. 6.2)
Red Hat Enterprise Linux Server EUS (v. 6.2.z)
Red Hat Enterprise Linux Workstation (v. 6)

Details

An updated passwd package that adds two enhancements is now available for Red
Hat Enterprise Linux 6.

The passwd packages contain a system utility, "passwd", which changes passwords
and displays password status information using the Pluggable Authentication
Modules (PAM) and Libuser libraries.

This update adds the following enhancements:

* The passwd command now supports a new option, "-e", that allows the system
administrator to expire the password of the specified user so that the user is
forced to change the password on the next login attempt. (BZ#791139)

* The passwd executable file is a setuid program so it needs to be well
protected against various types of attacks. With this update, passwd has been
built with the Position Independent Executables (PIE) flag, "-fPIE -pie", and
the full read-only relocations (RELRO) flags, "-Wl,-z,relro,-z,now". The passwd
binary is now well protected against "return-to-text" and memory corruption
attacks and also against attacks based on the program's ELF section overwriting.
(BZ#791143)

All users of passwd are advised to upgrade to this updated package, which adds
these enhancements.


Solution

Before applying this update, make sure all previously-released errata relevant
to your system have been applied.

This update is available via the Red Hat Network. Details on how to use the Red
Hat Network to apply this update are available at
http://kbase.redhat.com/faq/docs/DOC-11259

Updated packages

Red Hat Enterprise Linux Desktop (v. 6)

SRPMS:
passwd-0.77-4.el6_2.2.src.rpm     MD5: 756bc18e4fd6f1d606bbb97e36076afb
SHA-256: 0be34fa05661c78fa737d48238d3937eea784e96510808988a1aaf6daa958d5e
 
IA-32:
passwd-0.77-4.el6_2.2.i686.rpm     MD5: 2247b64523109f5f51aa4dff3c554854
SHA-256: c40eb82364776c84343599bc8a6f11a1ffae66b56f038e28b7545deba44948d9
passwd-debuginfo-0.77-4.el6_2.2.i686.rpm     MD5: e210bb777aa9ce8433a4f431abf3bdd1
SHA-256: 4772f23997d6266f10f1bc25d35e89c29d69b56896d47d71824cd9e588eacc12
 
x86_64:
passwd-0.77-4.el6_2.2.x86_64.rpm     MD5: f274213941fb2569b86fdc182bd9bbe9
SHA-256: 89e0ac24b9948d9e92261e8412860e6233b86bfb17e1012031bed2b341eafdb7
passwd-debuginfo-0.77-4.el6_2.2.x86_64.rpm     MD5: afeff090313ddbd29523523fe21e2706
SHA-256: 4cba1735e2ec9b4933e46178dd8a6613ac45bdd89e616e4d8f9d6ca725df762d
 
Red Hat Enterprise Linux HPC Node (v. 6)

SRPMS:
passwd-0.77-4.el6_2.2.src.rpm     MD5: 756bc18e4fd6f1d606bbb97e36076afb
SHA-256: 0be34fa05661c78fa737d48238d3937eea784e96510808988a1aaf6daa958d5e
 
x86_64:
passwd-0.77-4.el6_2.2.x86_64.rpm     MD5: f274213941fb2569b86fdc182bd9bbe9
SHA-256: 89e0ac24b9948d9e92261e8412860e6233b86bfb17e1012031bed2b341eafdb7
passwd-debuginfo-0.77-4.el6_2.2.x86_64.rpm     MD5: afeff090313ddbd29523523fe21e2706
SHA-256: 4cba1735e2ec9b4933e46178dd8a6613ac45bdd89e616e4d8f9d6ca725df762d
 
Red Hat Enterprise Linux Server (v. 6)

SRPMS:
passwd-0.77-4.el6_2.2.src.rpm     MD5: 756bc18e4fd6f1d606bbb97e36076afb
SHA-256: 0be34fa05661c78fa737d48238d3937eea784e96510808988a1aaf6daa958d5e
 
IA-32:
passwd-0.77-4.el6_2.2.i686.rpm     MD5: 2247b64523109f5f51aa4dff3c554854
SHA-256: c40eb82364776c84343599bc8a6f11a1ffae66b56f038e28b7545deba44948d9
passwd-debuginfo-0.77-4.el6_2.2.i686.rpm     MD5: e210bb777aa9ce8433a4f431abf3bdd1
SHA-256: 4772f23997d6266f10f1bc25d35e89c29d69b56896d47d71824cd9e588eacc12
 
PPC:
passwd-0.77-4.el6_2.2.ppc64.rpm     MD5: 0e3d0b859589566d779637ee0469d9b2
SHA-256: 00468ff84abc7721ad56236a7f5f7814085ecb5fb5f62f582d3bb01c7397be27
passwd-debuginfo-0.77-4.el6_2.2.ppc64.rpm     MD5: c3b9afab0c77329dde5a3426b1f9e66e
SHA-256: 3f8333eacdd21238e35fb8c6da44c76db32c8d4f4e53863a5fc24fcf4dbf395f
 
s390x:
passwd-0.77-4.el6_2.2.s390x.rpm     MD5: bf68785d3f5f413d7d67f25218c3187d
SHA-256: 4799a23aeca6fe40c89b5e064440f8e53b032942a00e81932f412544af12204a
passwd-debuginfo-0.77-4.el6_2.2.s390x.rpm     MD5: e1fd02ef99a382cd7c8697112371ebf5
SHA-256: 6d792827729ec98476486e2734ea1bb920129bf358d99808ac7ee21da30793ee
 
x86_64:
passwd-0.77-4.el6_2.2.x86_64.rpm     MD5: f274213941fb2569b86fdc182bd9bbe9
SHA-256: 89e0ac24b9948d9e92261e8412860e6233b86bfb17e1012031bed2b341eafdb7
passwd-debuginfo-0.77-4.el6_2.2.x86_64.rpm     MD5: afeff090313ddbd29523523fe21e2706
SHA-256: 4cba1735e2ec9b4933e46178dd8a6613ac45bdd89e616e4d8f9d6ca725df762d
 
Red Hat Enterprise Linux Server AUS (v. 6.2)

SRPMS:
passwd-0.77-4.el6_2.2.src.rpm     MD5: 756bc18e4fd6f1d606bbb97e36076afb
SHA-256: 0be34fa05661c78fa737d48238d3937eea784e96510808988a1aaf6daa958d5e
 
x86_64:
passwd-0.77-4.el6_2.2.x86_64.rpm     MD5: f274213941fb2569b86fdc182bd9bbe9
SHA-256: 89e0ac24b9948d9e92261e8412860e6233b86bfb17e1012031bed2b341eafdb7
passwd-debuginfo-0.77-4.el6_2.2.x86_64.rpm     MD5: afeff090313ddbd29523523fe21e2706
SHA-256: 4cba1735e2ec9b4933e46178dd8a6613ac45bdd89e616e4d8f9d6ca725df762d
 
Red Hat Enterprise Linux Server EUS (v. 6.2.z)

SRPMS:
passwd-0.77-4.el6_2.2.src.rpm     MD5: 756bc18e4fd6f1d606bbb97e36076afb
SHA-256: 0be34fa05661c78fa737d48238d3937eea784e96510808988a1aaf6daa958d5e
 
IA-32:
passwd-0.77-4.el6_2.2.i686.rpm     MD5: 2247b64523109f5f51aa4dff3c554854
SHA-256: c40eb82364776c84343599bc8a6f11a1ffae66b56f038e28b7545deba44948d9
passwd-debuginfo-0.77-4.el6_2.2.i686.rpm     MD5: e210bb777aa9ce8433a4f431abf3bdd1
SHA-256: 4772f23997d6266f10f1bc25d35e89c29d69b56896d47d71824cd9e588eacc12
 
PPC:
passwd-0.77-4.el6_2.2.ppc64.rpm     MD5: 0e3d0b859589566d779637ee0469d9b2
SHA-256: 00468ff84abc7721ad56236a7f5f7814085ecb5fb5f62f582d3bb01c7397be27
passwd-debuginfo-0.77-4.el6_2.2.ppc64.rpm     MD5: c3b9afab0c77329dde5a3426b1f9e66e
SHA-256: 3f8333eacdd21238e35fb8c6da44c76db32c8d4f4e53863a5fc24fcf4dbf395f
 
s390x:
passwd-0.77-4.el6_2.2.s390x.rpm     MD5: bf68785d3f5f413d7d67f25218c3187d
SHA-256: 4799a23aeca6fe40c89b5e064440f8e53b032942a00e81932f412544af12204a
passwd-debuginfo-0.77-4.el6_2.2.s390x.rpm     MD5: e1fd02ef99a382cd7c8697112371ebf5
SHA-256: 6d792827729ec98476486e2734ea1bb920129bf358d99808ac7ee21da30793ee
 
x86_64:
passwd-0.77-4.el6_2.2.x86_64.rpm     MD5: f274213941fb2569b86fdc182bd9bbe9
SHA-256: 89e0ac24b9948d9e92261e8412860e6233b86bfb17e1012031bed2b341eafdb7
passwd-debuginfo-0.77-4.el6_2.2.x86_64.rpm     MD5: afeff090313ddbd29523523fe21e2706
SHA-256: 4cba1735e2ec9b4933e46178dd8a6613ac45bdd89e616e4d8f9d6ca725df762d
 
Red Hat Enterprise Linux Workstation (v. 6)

SRPMS:
passwd-0.77-4.el6_2.2.src.rpm     MD5: 756bc18e4fd6f1d606bbb97e36076afb
SHA-256: 0be34fa05661c78fa737d48238d3937eea784e96510808988a1aaf6daa958d5e
 
IA-32:
passwd-0.77-4.el6_2.2.i686.rpm     MD5: 2247b64523109f5f51aa4dff3c554854
SHA-256: c40eb82364776c84343599bc8a6f11a1ffae66b56f038e28b7545deba44948d9
passwd-debuginfo-0.77-4.el6_2.2.i686.rpm     MD5: e210bb777aa9ce8433a4f431abf3bdd1
SHA-256: 4772f23997d6266f10f1bc25d35e89c29d69b56896d47d71824cd9e588eacc12
 
x86_64:
passwd-0.77-4.el6_2.2.x86_64.rpm     MD5: f274213941fb2569b86fdc182bd9bbe9
SHA-256: 89e0ac24b9948d9e92261e8412860e6233b86bfb17e1012031bed2b341eafdb7
passwd-debuginfo-0.77-4.el6_2.2.x86_64.rpm     MD5: afeff090313ddbd29523523fe21e2706
SHA-256: 4cba1735e2ec9b4933e46178dd8a6613ac45bdd89e616e4d8f9d6ca725df762d
 
(The unlinked packages above are only available from the Red Hat Network)

Bugs fixed (see bugzilla for more information)

791143 - passwd should be compiled with PIE and RELRO flags


Keywords

expire, password, PIE, RELRO, setuid


These packages are GPG signed by Red Hat for security. Our key and details on how to verify the signature are available from:
https://www.redhat.com/security/team/key/#package

The Red Hat security contact is secalert@redhat.com. More contact details at http://www.redhat.com/security/team/contact/