RHSA-2010:0891: Moderate: pam security update

Pluggable Authentication Modules (PAM) provide a system wherebyadministrators can set up authentication policies without having torecompile programs that handle authentication.It was discovered that the pamnamespace module executed the externalscript namespace.init with an unchanged environment inherited from anapplication calling PAM. In cases where such an environment was untrusted(for example, when pamnamespace was configured for setuid applicationssuch as su or sudo), a local, unprivileged user could possibly use thisflaw to escalate their privileges. (CVE-2010-3853)It was discovered that the pamenv and pammail modules used rootprivileges while accessing user's files. A local, unprivileged user coulduse this flaw to obtain information, from the lines that have the KEY=VALUEformat expected by pamenv, from an arbitrary file. Also, in certainconfigurations, a local, unprivileged user using a service for which thepammail module was configured for, could use this flaw to obtain limitedinformation about files or directories that they do not have access to.(CVE-2010-3435)Note: As part of the fix for CVE-2010-3435, this update changes the defaultvalue of pamenv's configuration option userreadenv to 0, causing themodule to not read user's ~/.pamenvironment configuration file by default,as reading it may introduce unexpected changes to the environment of theservice using PAM, or PAM modules consulted after pamenv.It was discovered that the pamxauth module did not verify the returnvalues of the setuid() and setgid() system calls. A local, unprivilegeduser could use this flaw to execute the xauth command with root privilegesand make it read an arbitrary input file. (CVE-2010-3316)Red Hat would like to thank Sebastian Krahmer of the SuSE Security Team forreporting the CVE-2010-3435 issue.All pam users should upgrade to these updated packages, which containbackported patches to correct these issues.