Bug 643043 (CVE-2010-3853) - CVE-2010-3853 pam: pam_namespace executes namespace.init with service's environment
Summary: CVE-2010-3853 pam: pam_namespace executes namespace.init with service's envir...
Keywords:
Status: CLOSED ERRATA
Alias: CVE-2010-3853
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
medium
medium
Target Milestone: ---
Assignee: Red Hat Product Security
QA Contact:
URL:
Whiteboard: impact=moderate,reported=20101014,pub...
Depends On: 642348 642349 644797 644798 833947
Blocks:
TreeView+ depends on / blocked
 
Reported: 2010-10-14 14:09 UTC by Tomas Hoger
Modified: 2019-06-08 13:08 UTC (History)
4 users (show)

Fixed In Version:
Doc Type: Bug Fix
Doc Text:
Clone Of:
Environment:
Last Closed: 2010-11-23 10:26:38 UTC


Attachments (Terms of Use)


Links
System ID Priority Status Summary Last Updated
Red Hat Product Errata RHSA-2010:0819 normal SHIPPED_LIVE Moderate: pam security update 2010-11-01 19:49:56 UTC
Red Hat Product Errata RHSA-2010:0891 normal SHIPPED_LIVE Moderate: pam security update 2010-11-16 17:51:52 UTC

Description Tomas Hoger 2010-10-14 14:09:16 UTC
Tomas Mraz pointed out that pam_namespace PAM module executes external namespace.init script with an environment settings inherited form the program or service that has pam_namespace configured.  Such environment may be untrusted in some cases (when running setuid program that does not sanitize environment prior to calling PAM), and may allow local user to escalate privileges.

Comment 2 Tomas Mraz 2010-10-14 18:15:11 UTC
Testing instructions:

1. add line:
/var/tmp /var/tmp-inst/   	user       ~root

to /etc/security/namespace.conf
2. add line:
session optional pam_namespace.so

to /etc/pam.d/sudo

3. add line
/usr/bin/printenv

to be executed in the /etc/security/namespace.init

4. add a command such as /usr/bin/id to be allowed in sudoers:
testuser ALL=(ALL) /usr/bin/id

5. run sudo /usr/bin/id as testuser and observe that the current environment of the calling user is printed - you can for example augment the PATH to anything you like.

Comment 8 errata-xmlrpc 2010-11-01 19:50:06 UTC
This issue has been addressed in following products:

  Red Hat Enterprise Linux 5

Via RHSA-2010:0819 https://rhn.redhat.com/errata/RHSA-2010-0819.html

Comment 9 errata-xmlrpc 2010-11-16 17:52:10 UTC
This issue has been addressed in following products:

  Red Hat Enterprise Linux 6

Via RHSA-2010:0891 https://rhn.redhat.com/errata/RHSA-2010-0891.html


Note You need to log in before you can comment on or make changes to this bug.