RHSA-2011:0170: libuser security update

Description

The libuser library implements a standardized interface for manipulatingand administering user and group accounts. Sample applications that aremodeled after applications from the shadow password suite (shadow-utils)are included in these packages.It was discovered that libuser did not set the password entry correctlywhen creating LDAP (Lightweight Directory Access Protocol) users. If anadministrator did not assign a password to an LDAP based user account,either at account creation with luseradd, or with lpasswd after accountcreation, an attacker could use this flaw to log into that account with adefault password string that should have been rejected. (CVE-2011-0002)Note: LDAP administrators that have used libuser tools to add users shouldcheck existing user accounts for plain text passwords, and reset them asnecessary.Users of libuser should upgrade to these updated packages, which contain abackported patch to correct this issue.