Rapid7 Vulnerability & Exploit Database

RHSA-2010:0891: pam security update

Back to Search

RHSA-2010:0891: pam security update



Pluggable Authentication Modules (PAM) provide a system wherebyadministrators can set up authentication policies without having torecompile programs that handle authentication.It was discovered that the pam_namespace module executed the externalscript namespace.init with an unchanged environment inherited from anapplication calling PAM. In cases where such an environment was untrusted(for example, when pam_namespace was configured for setuid applicationssuch as su or sudo), a local, unprivileged user could possibly use thisflaw to escalate their privileges. (CVE-2010-3853)It was discovered that the pam_env and pam_mail modules used rootprivileges while accessing user's files. A local, unprivileged user coulduse this flaw to obtain information, from the lines that have the KEY=VALUEformat expected by pam_env, from an arbitrary file. Also, in certainconfigurations, a local, unprivileged user using a service for which thepam_mail module was configured for, could use this flaw to obtain limitedinformation about files or directories that they do not have access to.(CVE-2010-3435)Note: As part of the fix for CVE-2010-3435, this update changes the defaultvalue of pam_env's configuration option user_readenv to 0, causing themodule to not read user's ~/.pam_environment configuration file by default,as reading it may introduce unexpected changes to the environment of theservice using PAM, or PAM modules consulted after pam_env.It was discovered that the pam_xauth module did not verify the returnvalues of the setuid() and setgid() system calls. A local, unprivilegeduser could use this flaw to execute the xauth command with root privilegesand make it read an arbitrary input file. (CVE-2010-3316)Red Hat would like to thank Sebastian Krahmer of the SuSE Security Team forreporting the CVE-2010-3435 issue.All pam users should upgrade to these updated packages, which containbackported patches to correct these issues.


  • redhat-upgrade-pam
  • redhat-upgrade-pam-debuginfo
  • redhat-upgrade-pam-devel

With Rapid7 live dashboards, I have a clear view of all the assets on my network, which ones can be exploited, and what I need to do in order to reduce the risk in my environment in real-time. No other tool gives us that kind of value and insight.

– Scott Cheney, Manager of Information Security, Sierra View Medical Center