Bug 746619 (CVE-2011-3148)
Summary: | CVE-2011-3148 pam (pam_env): Stack-based buffer overflow by parsing user's pam_environment file | ||
---|---|---|---|
Product: | [Other] Security Response | Reporter: | Jan Lieskovsky <jlieskov> |
Component: | vulnerability | Assignee: | Red Hat Product Security <security-response-team> |
Status: | CLOSED ERRATA | QA Contact: | |
Severity: | medium | Docs Contact: | |
Priority: | medium | ||
Version: | unspecified | CC: | brovvnout+rh, dapospis, john.haxby, security-response-team, tmraz |
Target Milestone: | --- | Keywords: | Reopened, Security |
Target Release: | --- | ||
Hardware: | All | ||
OS: | Linux | ||
Whiteboard: | |||
Fixed In Version: | Doc Type: | Bug Fix | |
Doc Text: | Story Points: | --- | |
Clone Of: | Environment: | ||
Last Closed: | 2013-02-22 04:33:43 UTC | Type: | --- |
Regression: | --- | Mount Type: | --- |
Documentation: | --- | CRM: | |
Verified Versions: | Category: | --- | |
oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |
Cloudforms Team: | --- | Target Upstream Version: | |
Embargoed: | |||
Bug Depends On: | 767503, 865990 | ||
Bug Blocks: | 746631, 855229 |
Description
Jan Lieskovsky
2011-10-17 10:06:01 UTC
Acknowledgements: Red Hat would like to thank Kees Cook of Google ChromeOS Team for reporting this issue. pam_env shipped in Red Hat Enterprise Linux 4 and Red Hat Enterprise Linux 5 does not support user defined environment files. Hence this issue does not affect Red Hat Enterprise Linux 4 and Red Hat Enterprise Linux 5. pam in Red Hat Enterprise Linux 6 disables reading user-supplied environment variables by default. From the man file: user_readenv=0|1 Turns on or off the reading of the user specific environment file. 0 is off, 1 is on. By default this option is off as user supplied environment variables in the PAM environment could affect behavior of subsequent modules in the stack without the consent of the system administrator. From the code: modules/pam_env/pam_env.c:13 #define DEFAULT_USER_READ_ENVFILE 0 This means that the admin will have to explicitly enable reading user-defined env. files via user_readenv=1 in the pam config file. Same goes for Fedora This issue does not affect the version of pam package, as shipped with Fedora 14 and 15. Public via: [1] https://bugs.launchpad.net/ubuntu/+source/pam/+bug/874469 Relevant upstream patch is: [2] http://git.fedorahosted.org/git/?p=linux-pam.git;a=commitdiff;h=caf5e7f61c8d9288daa49b4f61962e6b1239121d I don't understand why this is closed NOTABUG. The bug can be uncovered by setting the documented "user_readenv=1". Just because the system does not ship with the necessary setting does not mean that the bug does not exist. Unfortunately I am not able to reopen this bug, but I strongly recommend that you revisit this decision and if the you choose to leave it unopened you need to justify yourself. Also, if this is NOTABUG then CVE-2011-3149 (bug 746620) needs to be closed NOTABUG as well, in spite of fixes upstream. (In reply to comment #23) > Also, if this is NOTABUG then CVE-2011-3149 (bug 746620) needs to be closed > NOTABUG as well, in spite of fixes upstream. Both are different issues. This is a crash, CVE-2011-3149 is DoS (In reply to comment #21) > I don't understand why this is closed NOTABUG. The bug can be uncovered by > setting the documented "user_readenv=1". Just because the system does not > ship with the necessary setting does not mean that the bug does not exist. > > Unfortunately I am not able to reopen this bug, but I strongly recommend that > you revisit this decision and if the you choose to leave it unopened you need > to justify yourself. We dont ship the configuration need to exploit this bug by default. But that is not the reason why this bug is closed. The crash is caught by SSP, which aborts the application and stops the buffer from overwriting the function return value. However there may be other (more difficult) ways to exploit this issue, like guessing the canary values etc. Thus i am re-opening this issue. Created pam tracking bugs for this issue Affects: fedora-all [bug 767503] The version of pam package as shipped with Red Hat Enterprise Linux 5 do not support reading user specific environment file. (default is ~/.pam_environment). In Red Hat Enterprise Linux 6, reading user-supplied environment variables by default is explicitly disabled and will need to be enabled by adding "user_readenv=1" to the pam configuration file. (This can only be done as root). Even if the above option is enabled, the stack-based buffer overflow is caught by FORTIFY_SOURCE and hence is limited to application crash only. Statement: This issue did not affect the versions of pam package as shipped with Red Hat Enterprise Linux 5. This issue has been addressed in following products: Red Hat Enterprise Linux 6 Via RHSA-2013:0521 https://rhn.redhat.com/errata/RHSA-2013-0521.html |