Synopsis

Moderate: pam security update

Type/Severity

Security Advisory: Moderate

Topic

Updated pam packages that fix three security issues are now available for
Red Hat Enterprise Linux 5.

The Red Hat Security Response Team has rated this update as having moderate
security impact. Common Vulnerability Scoring System (CVSS) base scores,
which give detailed severity ratings, are available for each vulnerability
from the CVE links in the References section.

Description

Pluggable Authentication Modules (PAM) provide a system whereby
administrators can set up authentication policies without having to
recompile programs that handle authentication.

It was discovered that the pam_namespace module executed the external
script namespace.init with an unchanged environment inherited from an
application calling PAM. In cases where such an environment was untrusted
(for example, when pam_namespace was configured for setuid applications
such as su or sudo), a local, unprivileged user could possibly use this
flaw to escalate their privileges. (CVE-2010-3853)

It was discovered that the pam_mail module used root privileges while
accessing users' files. In certain configurations, a local, unprivileged
user could use this flaw to obtain limited information about files or
directories that they do not have access to. (CVE-2010-3435)

It was discovered that the pam_xauth module did not verify the return
values of the setuid() and setgid() system calls. A local, unprivileged
user could use this flaw to execute the xauth command with root privileges
and make it read an arbitrary input file. (CVE-2010-3316)

Red Hat would like to thank Sebastian Krahmer of the SuSE Security Team for
reporting the CVE-2010-3435 issue.

All pam users should upgrade to these updated packages, which contain
backported patches to correct these issues.

Solution

Before applying this update, make sure all previously-released errata
relevant to your system have been applied.

This update is available via the Red Hat Network. Details on how to
use the Red Hat Network to apply this update are available at
http://kbase.redhat.com/faq/docs/DOC-11259

Affected Products

• Red Hat Enterprise Linux Server 5 x86_64
• Red Hat Enterprise Linux Server 5 ia64
• Red Hat Enterprise Linux Server 5 i386
• Red Hat Enterprise Linux Workstation 5 x86_64
• Red Hat Enterprise Linux Workstation 5 i386
• Red Hat Enterprise Linux Desktop 5 x86_64
• Red Hat Enterprise Linux Desktop 5 i386
• Red Hat Enterprise Linux for IBM z Systems 5 s390x
• Red Hat Enterprise Linux for Power, big endian 5 ppc
• Red Hat Enterprise Linux Server from RHUI 5 x86_64
• Red Hat Enterprise Linux Server from RHUI 5 i386

Fixes

• BZ - 637898 - CVE-2010-3316 pam: pam_xauth missing return value checks from setuid() and similar calls
• BZ - 641335 - CVE-2010-3435 pam: pam_env and pam_mail accessing users' file with root privileges
• BZ - 643043 - CVE-2010-3853 pam: pam_namespace executes namespace.init with service's environment

CVEs

• CVE-2010-3853
• CVE-2010-3316
• CVE-2010-3435
• CVE-2010-4707

References

• http://www.redhat.com/security/updates/classification/#moderate

Red Hat Enterprise Linux Server 5

SRPM
pam-0.99.6.2-6.el5_5.2.src.rpm	SHA-256: 9ed891431d644824d5623a56fcad35c5cc858fa016520ddcb2bce533aa3f8217
x86_64
pam-0.99.6.2-6.el5_5.2.i386.rpm	SHA-256: 5fcdeb64dd7304f890a615c9b51e13314272d62eadaa3d915785e88628d1e3b0
pam-0.99.6.2-6.el5_5.2.x86_64.rpm	SHA-256: 6061a698283a8d07a4b225c2a15f797088818fe2a64d0504dce381078920d16f
pam-devel-0.99.6.2-6.el5_5.2.i386.rpm	SHA-256: a26389607f6ac3394cda85d670f82e56e01777a1c1ffda96affafdc1f9fcb3c3
pam-devel-0.99.6.2-6.el5_5.2.x86_64.rpm	SHA-256: 52fbf3f64dc2ca1b0251b460ce93bf2255df4f953574ab58ac21708d73f07a4b
ia64
pam-0.99.6.2-6.el5_5.2.i386.rpm	SHA-256: 5fcdeb64dd7304f890a615c9b51e13314272d62eadaa3d915785e88628d1e3b0
pam-0.99.6.2-6.el5_5.2.ia64.rpm	SHA-256: d12607782e81dc6471baac272fc09fb14cb17ee2a785505e016cfab92f79ce45
pam-devel-0.99.6.2-6.el5_5.2.ia64.rpm	SHA-256: 5b0033fbe58bc71863e836448e8c5755d169bd22cdd29a65aadc69af133be844
i386
pam-0.99.6.2-6.el5_5.2.i386.rpm	SHA-256: 5fcdeb64dd7304f890a615c9b51e13314272d62eadaa3d915785e88628d1e3b0
pam-devel-0.99.6.2-6.el5_5.2.i386.rpm	SHA-256: a26389607f6ac3394cda85d670f82e56e01777a1c1ffda96affafdc1f9fcb3c3

Red Hat Enterprise Linux Workstation 5

SRPM
pam-0.99.6.2-6.el5_5.2.src.rpm	SHA-256: 9ed891431d644824d5623a56fcad35c5cc858fa016520ddcb2bce533aa3f8217
x86_64
pam-0.99.6.2-6.el5_5.2.i386.rpm	SHA-256: 5fcdeb64dd7304f890a615c9b51e13314272d62eadaa3d915785e88628d1e3b0
pam-0.99.6.2-6.el5_5.2.x86_64.rpm	SHA-256: 6061a698283a8d07a4b225c2a15f797088818fe2a64d0504dce381078920d16f
pam-devel-0.99.6.2-6.el5_5.2.i386.rpm	SHA-256: a26389607f6ac3394cda85d670f82e56e01777a1c1ffda96affafdc1f9fcb3c3
pam-devel-0.99.6.2-6.el5_5.2.x86_64.rpm	SHA-256: 52fbf3f64dc2ca1b0251b460ce93bf2255df4f953574ab58ac21708d73f07a4b
i386
pam-0.99.6.2-6.el5_5.2.i386.rpm	SHA-256: 5fcdeb64dd7304f890a615c9b51e13314272d62eadaa3d915785e88628d1e3b0
pam-devel-0.99.6.2-6.el5_5.2.i386.rpm	SHA-256: a26389607f6ac3394cda85d670f82e56e01777a1c1ffda96affafdc1f9fcb3c3

Red Hat Enterprise Linux Desktop 5

SRPM
pam-0.99.6.2-6.el5_5.2.src.rpm	SHA-256: 9ed891431d644824d5623a56fcad35c5cc858fa016520ddcb2bce533aa3f8217
x86_64
pam-0.99.6.2-6.el5_5.2.i386.rpm	SHA-256: 5fcdeb64dd7304f890a615c9b51e13314272d62eadaa3d915785e88628d1e3b0
pam-0.99.6.2-6.el5_5.2.x86_64.rpm	SHA-256: 6061a698283a8d07a4b225c2a15f797088818fe2a64d0504dce381078920d16f
i386
pam-0.99.6.2-6.el5_5.2.i386.rpm	SHA-256: 5fcdeb64dd7304f890a615c9b51e13314272d62eadaa3d915785e88628d1e3b0

Red Hat Enterprise Linux for IBM z Systems 5

SRPM
pam-0.99.6.2-6.el5_5.2.src.rpm	SHA-256: 9ed891431d644824d5623a56fcad35c5cc858fa016520ddcb2bce533aa3f8217
s390x
pam-0.99.6.2-6.el5_5.2.s390.rpm	SHA-256: 3e903713d6c3c355eaf03fb799939cff4a187b5417aa507cb7970a1c8cb562bd
pam-0.99.6.2-6.el5_5.2.s390x.rpm	SHA-256: cd01b1db65083e0c5f076e04dfea4a66b47be40eadc5e52b01e50c95a8ec8551
pam-devel-0.99.6.2-6.el5_5.2.s390.rpm	SHA-256: c8da9e6a2c6f812c5d7558ddeeada1e71b9a90fe788d778a226e6c5555cb3ea0
pam-devel-0.99.6.2-6.el5_5.2.s390x.rpm	SHA-256: fd5c40e53a2e8a7c0f80b4c1fbd9cbca2e25dc37e88d43d1ae706c43cc7d1795

Red Hat Enterprise Linux for Power, big endian 5

SRPM
pam-0.99.6.2-6.el5_5.2.src.rpm	SHA-256: 9ed891431d644824d5623a56fcad35c5cc858fa016520ddcb2bce533aa3f8217
ppc
pam-0.99.6.2-6.el5_5.2.ppc.rpm	SHA-256: 77df572cbfbc59eafbbe13588ac09c5e0995d4dee30b5b7e3c21146c57ec7e1c
pam-0.99.6.2-6.el5_5.2.ppc64.rpm	SHA-256: 20c10da0885c119b74a3fc397b17950eae4df7c7dad0389c957b78a33612e491
pam-devel-0.99.6.2-6.el5_5.2.ppc.rpm	SHA-256: b3b7258b6b2ba070868035be506605abe357b9dfa3018c39eb8485cb1fa3bb23
pam-devel-0.99.6.2-6.el5_5.2.ppc64.rpm	SHA-256: facb7ddcfeca79e7f074ae9882aedc8dac697f8eb5a6ea0377ef2e09c45d3ca5

Red Hat Enterprise Linux Server from RHUI 5

SRPM
pam-0.99.6.2-6.el5_5.2.src.rpm	SHA-256: 9ed891431d644824d5623a56fcad35c5cc858fa016520ddcb2bce533aa3f8217
x86_64
pam-0.99.6.2-6.el5_5.2.i386.rpm	SHA-256: 5fcdeb64dd7304f890a615c9b51e13314272d62eadaa3d915785e88628d1e3b0
pam-0.99.6.2-6.el5_5.2.x86_64.rpm	SHA-256: 6061a698283a8d07a4b225c2a15f797088818fe2a64d0504dce381078920d16f
pam-devel-0.99.6.2-6.el5_5.2.i386.rpm	SHA-256: a26389607f6ac3394cda85d670f82e56e01777a1c1ffda96affafdc1f9fcb3c3
pam-devel-0.99.6.2-6.el5_5.2.x86_64.rpm	SHA-256: 52fbf3f64dc2ca1b0251b460ce93bf2255df4f953574ab58ac21708d73f07a4b
i386
pam-0.99.6.2-6.el5_5.2.i386.rpm	SHA-256: 5fcdeb64dd7304f890a615c9b51e13314272d62eadaa3d915785e88628d1e3b0
pam-devel-0.99.6.2-6.el5_5.2.i386.rpm	SHA-256: a26389607f6ac3394cda85d670f82e56e01777a1c1ffda96affafdc1f9fcb3c3