Ubuntu 11.04 USN-1140-1 Critical: PAM Access Control Errors

ubuntu

May 30, 2011

An attacker could cause PAM to read or delete arbitrary files or cause it to crash.

Summary

An attacker could cause PAM to read or delete arbitrary files or cause it

to crash.

Software Description:

- pam: Pluggable Authentication Modules

Details:

Marcus Granado discovered that PAM incorrectly handled configuration files

with non-ASCII usernames. A remote attacker could use this flaw to cause a

denial of service, or possibly obtain login access with a different users

username. This issue only affected Ubuntu 8.04 LTS. (CVE-2009-0887)

It was discovered that the PAM pam_xauth, pam_env and pam_mail modules

incorrectly handled dropping privileges when performing operations. A local

attacker could use this flaw to read certain arbitrary files, and access

other sensitive information. (CVE-2010-3316, CVE-2010-3430, CVE-2010-3431,

CVE-2010-3435)

It was discovered that the PAM pam_namespace module incorrectly cleaned the

environment during execution of the namespace.init script. A local attacker

could use this flaw to possibly gain privileges. (CVE-2010-3...

Read the Full Advisory

Topics Covered

security advisory denial of service access control Ubuntu PAM

Update Instructions

The problem can be corrected by updating your system to the following
package versions:

Ubuntu 11.04:
  libpam-modules                  1.1.2-2ubuntu8.2

Ubuntu 10.10:
  libpam-modules                  1.1.1-4ubuntu2.2

Ubuntu 10.04 LTS:
  libpam-modules                  1.1.1-2ubuntu5.2

Ubuntu 8.04 LTS:
  libpam-modules                  0.99.7.1-5ubuntu6.3

In general, a standard system update will make all the necessary changes.