Bug 643043 (CVE-2010-3853)

Summary:	CVE-2010-3853 pam: pam_namespace executes namespace.init with service's environment
Product:	[Other] Security Response	Reporter:	Tomas Hoger <thoger>
Component:	vulnerability	Assignee:	Red Hat Product Security <security-response-team>
Status:	CLOSED ERRATA	QA Contact:
Severity:	medium	Docs Contact:
Priority:	medium
Version:	unspecified	CC:	mvadkert, pruzicka, security-response-team, tmraz
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:		Doc Type:	Bug Fix
Doc Text:		Story Points:	---
Clone Of:		Environment:
Last Closed:	2010-11-23 10:26:38 UTC	Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:	642348, 642349, 644797, 644798, 833947
Bug Blocks:

Description Tomas Hoger 2010-10-14 14:09:16 UTC

Tomas Mraz pointed out that pam_namespace PAM module executes external namespace.init script with an environment settings inherited form the program or service that has pam_namespace configured.  Such environment may be untrusted in some cases (when running setuid program that does not sanitize environment prior to calling PAM), and may allow local user to escalate privileges.

Comment 2 Tomas Mraz 2010-10-14 18:15:11 UTC

Testing instructions:

1. add line:
/var/tmp /var/tmp-inst/   	user       ~root

to /etc/security/namespace.conf
2. add line:
session optional pam_namespace.so

to /etc/pam.d/sudo

3. add line
/usr/bin/printenv

to be executed in the /etc/security/namespace.init

4. add a command such as /usr/bin/id to be allowed in sudoers:
testuser ALL=(ALL) /usr/bin/id

5. run sudo /usr/bin/id as testuser and observe that the current environment of the calling user is printed - you can for example augment the PATH to anything you like.

Comment 6 Tomas Hoger 2010-10-25 13:46:17 UTC

Public now via upstream CVS commit:
http://pam.cvs.sourceforge.net/viewvc/pam/Linux-PAM/modules/pam_namespace/pam_namespace.c?view=log#rev1.13

Comment 8 errata-xmlrpc 2010-11-01 19:50:06 UTC

This issue has been addressed in following products:

  Red Hat Enterprise Linux 5

Via RHSA-2010:0819 https://rhn.redhat.com/errata/RHSA-2010-0819.html

Comment 9 errata-xmlrpc 2010-11-16 17:52:10 UTC

This issue has been addressed in following products:

  Red Hat Enterprise Linux 6

Via RHSA-2010:0891 https://rhn.redhat.com/errata/RHSA-2010-0891.html