PAM: Moderate Security Update

Users of PAM please be advised of a Moderate security update fix vulnerability that has been identified.
To view this vulnerability, possible remedies, and others please check out the Security Advisories at Critical Watch (http://criticalwatch.com/support/security-advisories.aspx)

RHSA-2010:0891-01: [RHSA-2010:0891-01] Moderate: pam security update
Product: Red Hat Enterprise Linux
Description:
It was discovered that the pam_namespace module executed the external

script namespace.init with an unchanged environment inherited from an

application calling PAM. In cases where such an environment was untrusted

(for example, when pam_namespace was configured for setuid applications

such as su or sudo), a local, unprivileged user could possibly use this

flaw to escalate their privileges. (CVE-2010-3853)
It was discovered that the pam_xauth module did not verify the return

values of the setuid() and setgid() system calls. A local, unprivileged

user could use this flaw to execute the xauth command with root privileges

and make it read an arbitrary input file. (CVE-2010-3316)

Read more at http://www.criticalwatch.com

 

Advertisements