REDHAT-BUG-641335: Low severity Linux-PAM Linux-PAM vulnerability
It was reported that pamenv and pammail modules do not drop privileges before accessing users' files. This flaw can lead to information disclosure.
Issue was partially addressed in Linux-PAM 1.1.2: http://git.altlinux.org/people/ldv/packages/?p=pam.git;a=commitdiff;h=06f882f30092a39a1db867c9744b2ca8d60e4ad6
The fix in 1.1.2 has some problems though, it fails to switch fsgid/egid and groups (CVE-2010-3430) and does not check setfsuid() return value (CVE-2010-3431): http://thread.gmane.org/gmane.comp.security.oss.general/3311/focus=3551
Fix using newly-introduced pammodutildroppriv / pammodutilregainpriv was committed in upstream CVS and should be included in 1.1.3: http://git.altlinux.org/people/ldv/packages/?p=pam.git;a=commitdiff;h=843807a3a90f52e7538be756616510730a24739a
Acknowledgements:
Red Hat would like to thank Sebastian Krahmer of the SuSE Security Team for reporting this issue.
Affected Software
Event History
Frequently Asked Questions
What is the severity of REDHAT-BUG-641335?
The severity of REDHAT-BUG-641335 is considered high due to its potential for information disclosure.
How do I fix REDHAT-BUG-641335?
To fix REDHAT-BUG-641335, update to Linux-PAM version 1.1.3 or later, where this issue is resolved.
Which versions of Linux-PAM are affected by REDHAT-BUG-641335?
Linux-PAM versions prior to 1.1.3 and including 1.1.2 are affected by REDHAT-BUG-641335.
What modules are involved in the REDHAT-BUG-641335 vulnerability?
The pam_env and pam_mail modules are involved in the REDHAT-BUG-641335 vulnerability.
How can REDHAT-BUG-641335 lead to information disclosure?
REDHAT-BUG-641335 can lead to information disclosure because the affected modules do not drop privileges before accessing user files.