Bug 643043 - (CVE-2010-3853) CVE-2010-3853 pam: pam_namespace executes namespace.init with service's environment
CVE-2010-3853 pam: pam_namespace executes namespace.init with service's envir...
Status: CLOSED ERRATA
Product: Security Response
Classification: Other
Component: vulnerability (Show other bugs)
unspecified
All Linux
medium Severity medium
: ---
: ---
Assigned To: Red Hat Product Security
impact=moderate,reported=20101014,pub...
: Security
Depends On: 642348 642349 644797 644798 833947
Blocks:
  Show dependency treegraph
 
Reported: 2010-10-14 10:09 EDT by Tomas Hoger
Modified: 2012-06-20 10:26 EDT (History)
4 users (show)

See Also:
Fixed In Version:
Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of:
Environment:
Last Closed: 2010-11-23 05:26:38 EST
Type: ---
Regression: ---
Mount Type: ---
Documentation: ---
CRM:
Verified Versions:
Category: ---
oVirt Team: ---
RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: ---


Attachments (Terms of Use)

  None (edit)
Description Tomas Hoger 2010-10-14 10:09:16 EDT
Tomas Mraz pointed out that pam_namespace PAM module executes external namespace.init script with an environment settings inherited form the program or service that has pam_namespace configured.  Such environment may be untrusted in some cases (when running setuid program that does not sanitize environment prior to calling PAM), and may allow local user to escalate privileges.
Comment 2 Tomas Mraz 2010-10-14 14:15:11 EDT
Testing instructions:

1. add line:
/var/tmp /var/tmp-inst/   	user       ~root

to /etc/security/namespace.conf
2. add line:
session optional pam_namespace.so

to /etc/pam.d/sudo

3. add line
/usr/bin/printenv

to be executed in the /etc/security/namespace.init

4. add a command such as /usr/bin/id to be allowed in sudoers:
testuser ALL=(ALL) /usr/bin/id

5. run sudo /usr/bin/id as testuser and observe that the current environment of the calling user is printed - you can for example augment the PATH to anything you like.
Comment 8 errata-xmlrpc 2010-11-01 15:50:06 EDT
This issue has been addressed in following products:

  Red Hat Enterprise Linux 5

Via RHSA-2010:0819 https://rhn.redhat.com/errata/RHSA-2010-0819.html
Comment 9 errata-xmlrpc 2010-11-16 12:52:10 EST
This issue has been addressed in following products:

  Red Hat Enterprise Linux 6

Via RHSA-2010:0891 https://rhn.redhat.com/errata/RHSA-2010-0891.html

Note You need to log in before you can comment on or make changes to this bug.