REDHAT-BUG-637898: Medium severity Linux-PAM Linux-PAM vulnerability
Tim Brown reported [1] a minor security flaw in pamxauth where the runcoprocess() function, which is responsible for running 'xauth nlist' as the existing user and 'xauth merge' as the target user does not check the return code on the setuid() call. An attacker with the ability to manipulate the number of processes running on the target account can cause RLIMITNPROC to be breached when runcoprocess() is called to execute 'xauth merge' as the target user.
This issue was assigned the name CVE-2010-3316 [2] and is corrected in Linux-PAM 1.1.2 [3].
It is not believed to be exploitable on current kernels, at least not via RLIMITNPROC [4].
[1] https://sourceforge.net/tracker/?func=detail&aid=3028213&groupid=6663&atid=106663 [2] http://www.openwall.com/lists/oss-security/2010/09/24/2 [3] http://git.altlinux.org/people/ldv/packages/?p=pam.git;a=commitdiff;h=06f882f30092a39a1db867c9744b2ca8d60e4ad6 [4] http://www.openwall.com/lists/oss-security/2010/09/21/11
Affected Software
Event History
Frequently Asked Questions
What is the severity of REDHAT-BUG-637898?
The severity of REDHAT-BUG-637898 is considered minor.
What is the impact of the vulnerability REDHAT-BUG-637898?
REDHAT-BUG-637898 can allow an attacker to manipulate user permissions due to improper error handling in the setuid() call.
How do I fix REDHAT-BUG-637898?
To fix REDHAT-BUG-637898, update to a patched version of Linux-PAM that resolves the security flaw.
Who is affected by REDHAT-BUG-637898?
Users of Linux-PAM versions prior to 1.1.2 are affected by REDHAT-BUG-637898.
What component of PAM is implicated in REDHAT-BUG-637898?
The vulnerable component in REDHAT-BUG-637898 is the run_coprocess() function within pam_xauth.