Red Hat Bugzilla – Full Text Bug Listing
|Summary:||CVE-2011-3148 pam (pam_env): Stack-based buffer overflow by parsing user's pam_environment file|
|Product:||[Other] Security Response||Reporter:||Jan Lieskovsky <jlieskov>|
|Component:||vulnerability||Assignee:||Red Hat Product Security <security-response-team>|
|Status:||CLOSED ERRATA||QA Contact:|
|Version:||unspecified||CC:||brovvnout+rh, dapospis, john.haxby, security-response-team, tmraz|
|Target Milestone:||---||Keywords:||Reopened, Security|
|Fixed In Version:||Doc Type:||Bug Fix|
|Doc Text:||Story Points:||---|
|Last Closed:||2013-02-21 23:33:43 EST||Type:||---|
|oVirt Team:||---||RHEL 7.3 requirements from Atomic Host:|
|Bug Depends On:||767503, 865990|
|Bug Blocks:||746631, 855229|
Description Jan Lieskovsky 2011-10-17 06:06:01 EDT
A stack-based buffer overflow flaw was found in the way the pam_env module of PAM (Pluggable Authentication Modules) security tool parsed content of user's ~/.pam_environment file for additional environment variables (the leading whitespace was not count into the count of bytes, which have been read into the buffer), when both pam_env module and reading of the user specific environment file were enabled. A local attacker could use this flaw to crash the pam_env module, or, potentially escalate their privileges.
Comment 1 Jan Lieskovsky 2011-10-17 06:08:00 EDT
Acknowledgements: Red Hat would like to thank Kees Cook of Google ChromeOS Team for reporting this issue.
Comment 8 Huzaifa S. Sidhpurwala 2011-10-18 01:03:03 EDT
pam_env shipped in Red Hat Enterprise Linux 4 and Red Hat Enterprise Linux 5 does not support user defined environment files. Hence this issue does not affect Red Hat Enterprise Linux 4 and Red Hat Enterprise Linux 5.
Comment 9 Huzaifa S. Sidhpurwala 2011-10-18 01:10:10 EDT
pam in Red Hat Enterprise Linux 6 disables reading user-supplied environment variables by default. From the man file: user_readenv=0|1 Turns on or off the reading of the user specific environment file. 0 is off, 1 is on. By default this option is off as user supplied environment variables in the PAM environment could affect behavior of subsequent modules in the stack without the consent of the system administrator. From the code: modules/pam_env/pam_env.c:13 #define DEFAULT_USER_READ_ENVFILE 0 This means that the admin will have to explicitly enable reading user-defined env. files via user_readenv=1 in the pam config file. Same goes for Fedora
Comment 19 Huzaifa S. Sidhpurwala 2011-10-21 00:42:46 EDT
This issue does not affect the version of pam package, as shipped with Fedora 14 and 15.
Comment 20 Jan Lieskovsky 2011-10-25 08:50:19 EDT
Public via:  https://bugs.launchpad.net/ubuntu/+source/pam/+bug/874469 Relevant upstream patch is:  http://git.fedorahosted.org/git/?p=linux-pam.git;a=commitdiff;h=caf5e7f61c8d9288daa49b4f61962e6b1239121d
Comment 21 firstname.lastname@example.org 2011-12-12 07:20:04 EST
I don't understand why this is closed NOTABUG. The bug can be uncovered by setting the documented "user_readenv=1". Just because the system does not ship with the necessary setting does not mean that the bug does not exist. Unfortunately I am not able to reopen this bug, but I strongly recommend that you revisit this decision and if the you choose to leave it unopened you need to justify yourself.
Comment 23 email@example.com 2011-12-12 08:28:13 EST
Also, if this is NOTABUG then CVE-2011-3149 (bug 746620) needs to be closed NOTABUG as well, in spite of fixes upstream.
Comment 24 Huzaifa S. Sidhpurwala 2011-12-14 03:50:14 EST
(In reply to comment #23) > Also, if this is NOTABUG then CVE-2011-3149 (bug 746620) needs to be closed > NOTABUG as well, in spite of fixes upstream. Both are different issues. This is a crash, CVE-2011-3149 is DoS
Comment 25 Huzaifa S. Sidhpurwala 2011-12-14 03:56:33 EST
(In reply to comment #21) > I don't understand why this is closed NOTABUG. The bug can be uncovered by > setting the documented "user_readenv=1". Just because the system does not > ship with the necessary setting does not mean that the bug does not exist. > > Unfortunately I am not able to reopen this bug, but I strongly recommend that > you revisit this decision and if the you choose to leave it unopened you need > to justify yourself. We dont ship the configuration need to exploit this bug by default. But that is not the reason why this bug is closed. The crash is caught by SSP, which aborts the application and stops the buffer from overwriting the function return value. However there may be other (more difficult) ways to exploit this issue, like guessing the canary values etc. Thus i am re-opening this issue.
Comment 27 Huzaifa S. Sidhpurwala 2011-12-14 04:02:23 EST
Created pam tracking bugs for this issue Affects: fedora-all [bug 767503]
Comment 37 Huzaifa S. Sidhpurwala 2013-01-16 23:30:01 EST
The version of pam package as shipped with Red Hat Enterprise Linux 5 do not support reading user specific environment file. (default is ~/.pam_environment). In Red Hat Enterprise Linux 6, reading user-supplied environment variables by default is explicitly disabled and will need to be enabled by adding "user_readenv=1" to the pam configuration file. (This can only be done as root). Even if the above option is enabled, the stack-based buffer overflow is caught by FORTIFY_SOURCE and hence is limited to application crash only. Statement: This issue did not affect the versions of pam package as shipped with Red Hat Enterprise Linux 5.