This service will be undergoing maintenance at 00:00 UTC, 2016-08-01. It is expected to last about 1 hours

Bug 746619 (CVE-2011-3148)

Summary: CVE-2011-3148 pam (pam_env): Stack-based buffer overflow by parsing user's pam_environment file
Product: [Other] Security Response Reporter: Jan Lieskovsky <jlieskov>
Component: vulnerabilityAssignee: Red Hat Product Security <security-response-team>
Status: CLOSED ERRATA QA Contact:
Severity: medium Docs Contact:
Priority: medium    
Version: unspecifiedCC: brovvnout+rh, dapospis, john.haxby, security-response-team, tmraz
Target Milestone: ---Keywords: Reopened, Security
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard: impact=moderate,public=20111024,reported=20111014,source=distros,cvss2=3.7/AV:L/AC:H/Au:N/C:P/I:P/A:P,rhel-4/pam=notaffected,rhel-5/pam=notaffected,rhel-6/pam=affected,fedora-all/pam=affected,cwe=CWE-121[auto]
Fixed In Version: Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of: Environment:
Last Closed: 2013-02-21 23:33:43 EST Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Bug Depends On: 767503, 865990    
Bug Blocks: 746631, 855229    

Description Jan Lieskovsky 2011-10-17 06:06:01 EDT
A stack-based buffer overflow flaw was found in the way the pam_env module of PAM (Pluggable Authentication Modules) security tool parsed content of user's ~/.pam_environment file for additional environment variables (the leading whitespace was not count into the count of bytes, which have been read into the buffer), when both pam_env module and reading of the user specific environment file were enabled. A local attacker could use this flaw to crash the pam_env module, or, potentially escalate their privileges.
Comment 1 Jan Lieskovsky 2011-10-17 06:08:00 EDT
Acknowledgements:

Red Hat would like to thank Kees Cook of Google ChromeOS Team for reporting this issue.
Comment 8 Huzaifa S. Sidhpurwala 2011-10-18 01:03:03 EDT
pam_env shipped in Red Hat Enterprise Linux 4 and Red Hat Enterprise Linux 5 does not support user defined environment files. Hence this issue does not affect Red Hat Enterprise Linux 4 and Red Hat Enterprise Linux 5.
Comment 9 Huzaifa S. Sidhpurwala 2011-10-18 01:10:10 EDT
pam in Red Hat Enterprise Linux 6 disables reading user-supplied environment variables by default.

From the man file:

user_readenv=0|1
Turns on or off the reading of the user specific environment file. 0 is off, 1 is on. By default this option is off as user supplied environment variables in the PAM environment could affect behavior of subsequent modules in the stack without the consent of the system administrator.

From the code:
modules/pam_env/pam_env.c:13
#define DEFAULT_USER_READ_ENVFILE 0

This means that the admin will have to explicitly enable reading user-defined env. files via user_readenv=1 in the pam config file.

Same goes for Fedora
Comment 19 Huzaifa S. Sidhpurwala 2011-10-21 00:42:46 EDT
This issue does not affect the version of pam package, as shipped with Fedora 14 and 15.
Comment 21 john.haxby@oracle.com 2011-12-12 07:20:04 EST
I don't understand why this is closed NOTABUG.   The bug can be uncovered by setting the documented "user_readenv=1".   Just because the system does not ship with the necessary setting does not mean that the bug does not exist.

Unfortunately I am not able to reopen this bug, but I strongly recommend that you revisit this decision and if the you choose to leave it unopened you need to justify yourself.
Comment 23 john.haxby@oracle.com 2011-12-12 08:28:13 EST
Also, if this is NOTABUG then CVE-2011-3149 (bug 746620) needs to be closed NOTABUG as well, in spite of fixes upstream.
Comment 24 Huzaifa S. Sidhpurwala 2011-12-14 03:50:14 EST
(In reply to comment #23)
> Also, if this is NOTABUG then CVE-2011-3149 (bug 746620) needs to be closed
> NOTABUG as well, in spite of fixes upstream.

Both are different issues. This is a crash, CVE-2011-3149 is DoS
Comment 25 Huzaifa S. Sidhpurwala 2011-12-14 03:56:33 EST
(In reply to comment #21)
> I don't understand why this is closed NOTABUG.   The bug can be uncovered by
> setting the documented "user_readenv=1".   Just because the system does not
> ship with the necessary setting does not mean that the bug does not exist.
> 
> Unfortunately I am not able to reopen this bug, but I strongly recommend that
> you revisit this decision and if the you choose to leave it unopened you need
> to justify yourself.

We dont ship the configuration need to exploit this bug by default. But that is not the reason why this bug is closed. The crash is caught by SSP, which aborts the application and stops the buffer from overwriting the function return value.

However there may be other (more difficult) ways to exploit this issue, like guessing the canary values etc. Thus i am re-opening this issue.
Comment 27 Huzaifa S. Sidhpurwala 2011-12-14 04:02:23 EST
Created pam tracking bugs for this issue

Affects: fedora-all [bug 767503]
Comment 37 Huzaifa S. Sidhpurwala 2013-01-16 23:30:01 EST
The version of pam package as shipped with Red Hat Enterprise Linux 5 do not support reading user specific environment file. (default is ~/.pam_environment).

In Red Hat Enterprise Linux 6, reading user-supplied environment variables by default is explicitly disabled and will need to be enabled by adding "user_readenv=1" to the pam configuration file. (This can only be done as root). Even if the above option is enabled, the stack-based buffer overflow is caught by FORTIFY_SOURCE and hence is limited to application crash only.

Statement:

This issue did not affect the versions of pam package as shipped with Red Hat Enterprise Linux 5.
Comment 38 errata-xmlrpc 2013-02-21 05:36:36 EST
This issue has been addressed in following products:

  Red Hat Enterprise Linux 6

Via RHSA-2013:0521 https://rhn.redhat.com/errata/RHSA-2013-0521.html