REDHAT-BUG-641361: Medium severity Linux-PAM Linux-PAM vulnerability
The pammail and pamenv modules in Linux-PAM before 1.1.2 did not drop privileges before accessing users' files (CVE-2010-3435, see bug #641335). Privilege dropping was added in 1.1.2, but with couple of issues pointed out by Solar Designer:
http://thread.gmane.org/gmane.comp.security.oss.general/3311/focus=3534
The code fails to switch fsgid/egid and groups (CVE-2010-3430) and does not check setfsuid() return value (CVE-2010-3431). Fix using newly-introduced pammodutildroppriv / pammodutilregainpriv was committed in upstream CVS and should be included in 1.1.3: http://git.altlinux.org/people/ldv/packages/?p=pam.git;a=commitdiff;h=843807a3a90f52e7538be756616510730a24739a
Affected Software
Event History
Frequently Asked Questions
What is the severity of REDHAT-BUG-641361?
The severity of REDHAT-BUG-641361 is classified as high due to privilege escalation risks.
How do I fix REDHAT-BUG-641361?
To fix REDHAT-BUG-641361, upgrade your Linux-PAM to version 1.1.3 or later.
What systems are affected by REDHAT-BUG-641361?
REDHAT-BUG-641361 affects all versions of Linux-PAM prior to 1.1.3.
What are the potential impacts of REDHAT-BUG-641361?
The potential impacts of REDHAT-BUG-641361 include unauthorized access to user files and potential privilege escalation.
Is there a workaround for REDHAT-BUG-641361?
A temporary workaround for REDHAT-BUG-641361 is to restrict access to the pam_mail and pam_env modules until they can be updated.