Bug 746619 - (CVE-2011-3148) CVE-2011-3148 pam (pam_env): Stack-based buffer overflow by parsing user's pam_environment file
CVE-2011-3148 pam (pam_env): Stack-based buffer overflow by parsing user's pa...
Status: CLOSED ERRATA
Product: Security Response
Classification: Other
Component: vulnerability (Show other bugs)
unspecified
All Linux
medium Severity medium
: ---
: ---
Assigned To: Red Hat Product Security
impact=moderate,public=20111024,repor...
: Reopened, Security
Depends On: 767503 865990
Blocks: 746631 855229
  Show dependency treegraph
 
Reported: 2011-10-17 06:06 EDT by Jan Lieskovsky
Modified: 2016-03-04 06:13 EST (History)
5 users (show)

See Also:
Fixed In Version:
Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of:
Environment:
Last Closed: 2013-02-21 23:33:43 EST
Type: ---
Regression: ---
Mount Type: ---
Documentation: ---
CRM:
Verified Versions:
Category: ---
oVirt Team: ---
RHEL 7.3 requirements from Atomic Host:


Attachments (Terms of Use)

  None (edit)
Description Jan Lieskovsky 2011-10-17 06:06:01 EDT
A stack-based buffer overflow flaw was found in the way the pam_env module of PAM (Pluggable Authentication Modules) security tool parsed content of user's ~/.pam_environment file for additional environment variables (the leading whitespace was not count into the count of bytes, which have been read into the buffer), when both pam_env module and reading of the user specific environment file were enabled. A local attacker could use this flaw to crash the pam_env module, or, potentially escalate their privileges.
Comment 1 Jan Lieskovsky 2011-10-17 06:08:00 EDT
Acknowledgements:

Red Hat would like to thank Kees Cook of Google ChromeOS Team for reporting this issue.
Comment 8 Huzaifa S. Sidhpurwala 2011-10-18 01:03:03 EDT
pam_env shipped in Red Hat Enterprise Linux 4 and Red Hat Enterprise Linux 5 does not support user defined environment files. Hence this issue does not affect Red Hat Enterprise Linux 4 and Red Hat Enterprise Linux 5.
Comment 9 Huzaifa S. Sidhpurwala 2011-10-18 01:10:10 EDT
pam in Red Hat Enterprise Linux 6 disables reading user-supplied environment variables by default.

From the man file:

user_readenv=0|1
Turns on or off the reading of the user specific environment file. 0 is off, 1 is on. By default this option is off as user supplied environment variables in the PAM environment could affect behavior of subsequent modules in the stack without the consent of the system administrator.

From the code:
modules/pam_env/pam_env.c:13
#define DEFAULT_USER_READ_ENVFILE 0

This means that the admin will have to explicitly enable reading user-defined env. files via user_readenv=1 in the pam config file.

Same goes for Fedora
Comment 19 Huzaifa S. Sidhpurwala 2011-10-21 00:42:46 EDT
This issue does not affect the version of pam package, as shipped with Fedora 14 and 15.
Comment 21 john.haxby@oracle.com 2011-12-12 07:20:04 EST
I don't understand why this is closed NOTABUG.   The bug can be uncovered by setting the documented "user_readenv=1".   Just because the system does not ship with the necessary setting does not mean that the bug does not exist.

Unfortunately I am not able to reopen this bug, but I strongly recommend that you revisit this decision and if the you choose to leave it unopened you need to justify yourself.
Comment 23 john.haxby@oracle.com 2011-12-12 08:28:13 EST
Also, if this is NOTABUG then CVE-2011-3149 (bug 746620) needs to be closed NOTABUG as well, in spite of fixes upstream.
Comment 24 Huzaifa S. Sidhpurwala 2011-12-14 03:50:14 EST
(In reply to comment #23)
> Also, if this is NOTABUG then CVE-2011-3149 (bug 746620) needs to be closed
> NOTABUG as well, in spite of fixes upstream.

Both are different issues. This is a crash, CVE-2011-3149 is DoS
Comment 25 Huzaifa S. Sidhpurwala 2011-12-14 03:56:33 EST
(In reply to comment #21)
> I don't understand why this is closed NOTABUG.   The bug can be uncovered by
> setting the documented "user_readenv=1".   Just because the system does not
> ship with the necessary setting does not mean that the bug does not exist.
> 
> Unfortunately I am not able to reopen this bug, but I strongly recommend that
> you revisit this decision and if the you choose to leave it unopened you need
> to justify yourself.

We dont ship the configuration need to exploit this bug by default. But that is not the reason why this bug is closed. The crash is caught by SSP, which aborts the application and stops the buffer from overwriting the function return value.

However there may be other (more difficult) ways to exploit this issue, like guessing the canary values etc. Thus i am re-opening this issue.
Comment 27 Huzaifa S. Sidhpurwala 2011-12-14 04:02:23 EST
Created pam tracking bugs for this issue

Affects: fedora-all [bug 767503]
Comment 37 Huzaifa S. Sidhpurwala 2013-01-16 23:30:01 EST
The version of pam package as shipped with Red Hat Enterprise Linux 5 do not support reading user specific environment file. (default is ~/.pam_environment).

In Red Hat Enterprise Linux 6, reading user-supplied environment variables by default is explicitly disabled and will need to be enabled by adding "user_readenv=1" to the pam configuration file. (This can only be done as root). Even if the above option is enabled, the stack-based buffer overflow is caught by FORTIFY_SOURCE and hence is limited to application crash only.

Statement:

This issue did not affect the versions of pam package as shipped with Red Hat Enterprise Linux 5.
Comment 38 errata-xmlrpc 2013-02-21 05:36:36 EST
This issue has been addressed in following products:

  Red Hat Enterprise Linux 6

Via RHSA-2013:0521 https://rhn.redhat.com/errata/RHSA-2013-0521.html

Note You need to log in before you can comment on or make changes to this bug.