Ubuntu 11.10 PAM Denial of Service: USN-1237-1 Critical Threat

ubuntu

October 24, 2011

PAM could be made to crash or run programs as an administrator.

Summary

PAM could be made to crash or run programs as an administrator.

Software Description:

- pam: Pluggable Authentication Modules

Details:

Kees Cook discovered that the PAM pam_env module incorrectly handled

certain malformed environment files. A local attacker could use this flaw

to cause a denial of service, or possibly gain privileges. The default

compiler options for affected releases should reduce the vulnerability to a

denial of service. (CVE-2011-3148)

Kees Cook discovered that the PAM pam_env module incorrectly handled

variable expansion. A local attacker could use this flaw to cause a denial

of service. (CVE-2011-3149)

Stephane Chazelas discovered that the PAM pam_motd module incorrectly

cleaned the environment during execution of the motd scripts. In certain

environments, a local attacker could use this to execute arbitrary code

as root, and gain privileges.

Topics Covered

security advisory denial of service privilege escalation system update ubuntu pam admin risks

Update Instructions

The problem can be corrected by updating your system to the following
package versions:

Ubuntu 11.10:
  libpam-modules                  1.1.3-2ubuntu2.1

Ubuntu 11.04:
  libpam-modules                  1.1.2-2ubuntu8.4

Ubuntu 10.10:
  libpam-modules                  1.1.1-4ubuntu2.4

Ubuntu 10.04 LTS:
  libpam-modules                  1.1.1-2ubuntu5.4

Ubuntu 8.04 LTS:
  libpam-modules                  0.99.7.1-5ubuntu6.5

In general, a standard system update will make all the necessary changes.