RHSA-2010:0819: Moderate: pam security update

Pluggable Authentication Modules (PAM) provide a system wherebyadministrators can set up authentication policies without having torecompile programs that handle authentication.It was discovered that the pamnamespace module executed the externalscript namespace.init with an unchanged environment inherited from anapplication calling PAM. In cases where such an environment was untrusted(for example, when pamnamespace was configured for setuid applicationssuch as su or sudo), a local, unprivileged user could possibly use thisflaw to escalate their privileges. (CVE-2010-3853)It was discovered that the pammail module used root privileges whileaccessing users' files. In certain configurations, a local, unprivilegeduser could use this flaw to obtain limited information about files ordirectories that they do not have access to. (CVE-2010-3435)It was discovered that the pamxauth module did not verify the returnvalues of the setuid() and setgid() system calls. A local, unprivilegeduser could use this flaw to execute the xauth command with root privilegesand make it read an arbitrary input file. (CVE-2010-3316)Red Hat would like to thank Sebastian Krahmer of the SuSE Security Team forreporting the CVE-2010-3435 issue.All pam users should upgrade to these updated packages, which containbackported patches to correct these issues.