The new OpenSSH 3.0.2 fixes a vulnerability in the UseLogin option. By default, Mandrake Linux does not enable UseLogin, but if the administrator enables it, local users are able to pass environment variables to the login process.
The default pam files for the passwd program did not include support for md5 passwords, thus any password changes or post-install added users would not have md5 passwords.
To browse through our weekly Linux Advisory Watch newsletters,