Executive Summary
Summary | |
---|---|
Title | PAM vulnerabilities |
Informations | |||
---|---|---|---|
Name | USN-1140-1 | First vendor Publication | 2011-05-30 |
Vendor | Ubuntu | Last vendor Modification | 2011-05-30 |
Severity (Vendor) | N/A | Revision | N/A |
Security-Database Scoring CVSS v3
Cvss vector : N/A | |||
---|---|---|---|
Overall CVSS Score | NA | ||
Base Score | NA | Environmental Score | NA |
impact SubScore | NA | Temporal Score | NA |
Exploitabality Sub Score | NA | ||
Calculate full CVSS 3.0 Vectors scores |
Security-Database Scoring CVSS v2
Cvss vector : (AV:L/AC:M/Au:N/C:C/I:C/A:C) | |||
---|---|---|---|
Cvss Base Score | 6.9 | Attack Range | Local |
Cvss Impact Score | 10 | Attack Complexity | Medium |
Cvss Expoit Score | 3.4 | Authentication | None Required |
Calculate full CVSS 2.0 Vectors scores |
Detail
A security issue affects these releases of Ubuntu and its derivatives: - Ubuntu 11.04 - Ubuntu 10.10 - Ubuntu 10.04 LTS - Ubuntu 8.04 LTS Summary: An attacker could cause PAM to read or delete arbitrary files or cause it to crash. Software Description: - pam: Pluggable Authentication Modules Details: Marcus Granado discovered that PAM incorrectly handled configuration files with non-ASCII usernames. A remote attacker could use this flaw to cause a denial of service, or possibly obtain login access with a different users username. This issue only affected Ubuntu 8.04 LTS. (CVE-2009-0887) It was discovered that the PAM pam_xauth, pam_env and pam_mail modules incorrectly handled dropping privileges when performing operations. A local attacker could use this flaw to read certain arbitrary files, and access other sensitive information. (CVE-2010-3316, CVE-2010-3430, CVE-2010-3431, CVE-2010-3435) It was discovered that the PAM pam_namespace module incorrectly cleaned the environment during execution of the namespace.init script. A local attacker could use this flaw to possibly gain privileges. (CVE-2010-3853) It was discovered that the PAM pam_xauth module incorrectly handled certain failures. A local attacker could use this flaw to delete certain unintended files. (CVE-2010-4706) It was discovered that the PAM pam_xauth module incorrectly verified certain file properties. A local attacker could use this flaw to cause a denial of service. (CVE-2010-4707) Update instructions: The problem can be corrected by updating your system to the following package versions: Ubuntu 11.04: Ubuntu 10.10: Ubuntu 10.04 LTS: Ubuntu 8.04 LTS: In general, a standard system update will make all the necessary changes. References: Package Information: |
Original Source
Url : http://www.ubuntu.com/usn/USN-1140-1 |
CWE : Common Weakness Enumeration
% | Id | Name |
---|---|---|
50 % | CWE-399 | Resource Management Errors |
50 % | CWE-189 | Numeric Errors (CWE/SANS Top 25) |
OVAL Definitions
Definition Id: oval:org.mitre.oval:def:13730 | |||
Oval ID: | oval:org.mitre.oval:def:13730 | ||
Title: | USN-1140-2 -- pam regression | ||
Description: | pam: Pluggable Authentication Modules Details: USN-1140-1 fixed vulnerabilities in PAM. A regression was found that caused cron to stop working with a "Module is unknown" error. As a result, systems configured with automatic updates will not receive updates until cron is restarted, these updates are installed or the system is rebooted. This update fixes the problem. We apologize for the inconvenience. Original advisory The USN-1140-1 PAM update caused cron to stop working. | ||
Family: | unix | Class: | patch |
Reference(s): | USN-1140-2 CVE-2009-0887 CVE-2010-3316 CVE-2010-3430 CVE-2010-3431 CVE-2010-3435 CVE-2010-3853 CVE-2010-4706 CVE-2010-4707 | Version: | 5 |
Platform(s): | Ubuntu 10.10 Ubuntu 8.04 Ubuntu 10.04 | Product(s): | pam |
Definition Synopsis: | |||
|
Definition Id: oval:org.mitre.oval:def:13977 | |||
Oval ID: | oval:org.mitre.oval:def:13977 | ||
Title: | USN-1140-1 -- pam vulnerabilities | ||
Description: | pam: Pluggable Authentication Modules An attacker could cause PAM to read or delete arbitrary files or cause it to crash. | ||
Family: | unix | Class: | patch |
Reference(s): | USN-1140-1 CVE-2009-0887 CVE-2010-3316 CVE-2010-3430 CVE-2010-3431 CVE-2010-3435 CVE-2010-3853 CVE-2010-4706 CVE-2010-4707 | Version: | 5 |
Platform(s): | Ubuntu 10.10 Ubuntu 8.04 Ubuntu 10.04 | Product(s): | pam |
Definition Synopsis: | |||
|
Definition Id: oval:org.mitre.oval:def:19576 | |||
Oval ID: | oval:org.mitre.oval:def:19576 | ||
Title: | VMware ESX/ESXi SLPD denial of service vulnerability and ESX third party updates for Service Console packages bind, pam, and rpm. | ||
Description: | pam_namespace.c in the pam_namespace module in Linux-PAM (aka pam) before 1.1.3 uses the environment of the invoking application or service during execution of the namespace.init script, which might allow local users to gain privileges by running a setuid program that relies on the pam_namespace PAM check, as demonstrated by the sudo program. | ||
Family: | unix | Class: | vulnerability |
Reference(s): | CVE-2010-3853 | Version: | 4 |
Platform(s): | VMWare ESX Server 4.1 VMWare ESX Server 4.0 | Product(s): | |
Definition Synopsis: | |||
|
Definition Id: oval:org.mitre.oval:def:19932 | |||
Oval ID: | oval:org.mitre.oval:def:19932 | ||
Title: | VMware ESX/ESXi SLPD denial of service vulnerability and ESX third party updates for Service Console packages bind, pam, and rpm. | ||
Description: | The run_coprocess function in pam_xauth.c in the pam_xauth module in Linux-PAM (aka pam) before 1.1.2 does not check the return values of the setuid, setgid, and setgroups system calls, which might allow local users to read arbitrary files by executing a program that relies on the pam_xauth PAM check. | ||
Family: | unix | Class: | vulnerability |
Reference(s): | CVE-2010-3316 | Version: | 4 |
Platform(s): | VMWare ESX Server 4.1 VMWare ESX Server 4.0 | Product(s): | |
Definition Synopsis: | |||
|
Definition Id: oval:org.mitre.oval:def:20251 | |||
Oval ID: | oval:org.mitre.oval:def:20251 | ||
Title: | VMware ESX/ESXi SLPD denial of service vulnerability and ESX third party updates for Service Console packages bind, pam, and rpm. | ||
Description: | The (1) pam_env and (2) pam_mail modules in Linux-PAM (aka pam) before 1.1.2 use root privileges during read access to files and directories that belong to arbitrary user accounts, which might allow local users to obtain sensitive information by leveraging this filesystem activity, as demonstrated by a symlink attack on the .pam_environment file in a user's home directory. | ||
Family: | unix | Class: | vulnerability |
Reference(s): | CVE-2010-3435 | Version: | 4 |
Platform(s): | VMWare ESX Server 4.1 VMWare ESX Server 4.0 | Product(s): | |
Definition Synopsis: | |||
|
Definition Id: oval:org.mitre.oval:def:22164 | |||
Oval ID: | oval:org.mitre.oval:def:22164 | ||
Title: | RHSA-2010:0819: pam security update (Moderate) | ||
Description: | The check_acl function in pam_xauth.c in the pam_xauth module in Linux-PAM (aka pam) 1.1.2 and earlier does not verify that a certain ACL file is a regular file, which might allow local users to cause a denial of service (resource consumption) via a special file. | ||
Family: | unix | Class: | patch |
Reference(s): | RHSA-2010:0819-01 CESA-2010:0819 CVE-2010-3316 CVE-2010-3435 CVE-2010-3853 CVE-2010-4707 | Version: | 55 |
Platform(s): | Red Hat Enterprise Linux 5 CentOS Linux 5 | Product(s): | pam |
Definition Synopsis: | |||
Definition Id: oval:org.mitre.oval:def:23155 | |||
Oval ID: | oval:org.mitre.oval:def:23155 | ||
Title: | ELSA-2010:0819: pam security update (Moderate) | ||
Description: | The check_acl function in pam_xauth.c in the pam_xauth module in Linux-PAM (aka pam) 1.1.2 and earlier does not verify that a certain ACL file is a regular file, which might allow local users to cause a denial of service (resource consumption) via a special file. | ||
Family: | unix | Class: | patch |
Reference(s): | ELSA-2010:0819-01 CVE-2010-3316 CVE-2010-3435 CVE-2010-3853 CVE-2010-4707 | Version: | 21 |
Platform(s): | Oracle Linux 5 | Product(s): | pam |
Definition Synopsis: | |||
Definition Id: oval:org.mitre.oval:def:27934 | |||
Oval ID: | oval:org.mitre.oval:def:27934 | ||
Title: | DEPRECATED: ELSA-2010-0819 -- pam security update (moderate) | ||
Description: | [0.99.6.2-6.2] - fix insecure dropping of priviledges in pam_xauth and pam_mail - CVE-2010-3316 (#637898), CVE-2010-3435 (#641335) - fix insecure executing of scripts with user supplied environment variables in pam_namespace - CVE-2010-3853 (#643043) | ||
Family: | unix | Class: | patch |
Reference(s): | ELSA-2010-0819 CVE-2010-3316 CVE-2010-3435 CVE-2010-3853 CVE-2010-4707 | Version: | 4 |
Platform(s): | Oracle Linux 5 | Product(s): | pam |
Definition Synopsis: | |||
CPE : Common Platform Enumeration
OpenVAS Exploits
Date | Description |
---|---|
2012-08-10 | Name : Gentoo Security Advisory GLSA 201206-31 (pam) File : nvt/glsa_201206_31.nasl |
2012-03-16 | Name : VMSA-2011-0004.3 VMware ESX/ESXi SLPD denial of service vulnerability and ESX... File : nvt/gb_VMSA-2011-0004.nasl |
2011-06-06 | Name : Ubuntu Update for pam USN-1140-1 File : nvt/gb_ubuntu_USN_1140_1.nasl |
2011-06-06 | Name : Ubuntu Update for pam USN-1140-2 File : nvt/gb_ubuntu_USN_1140_2.nasl |
2010-12-02 | Name : Fedora Update for pam FEDORA-2010-17155 File : nvt/gb_fedora_2010_17155_pam_fc14.nasl |
2010-11-23 | Name : Fedora Update for pam FEDORA-2010-17133 File : nvt/gb_fedora_2010_17133_pam_fc12.nasl |
2010-11-16 | Name : RedHat Update for pam RHSA-2010:0819-01 File : nvt/gb_RHSA-2010_0819-01_pam.nasl |
2010-11-16 | Name : Fedora Update for pam FEDORA-2010-17112 File : nvt/gb_fedora_2010_17112_pam_fc13.nasl |
2010-11-16 | Name : Mandriva Update for pam MDVSA-2010:220 (pam) File : nvt/gb_mandriva_MDVSA_2010_220.nasl |
2009-09-09 | Name : Gentoo Security Advisory GLSA 200909-01 (pam) File : nvt/glsa_200909_01.nasl |
2009-04-15 | Name : Fedora Core 10 FEDORA-2009-3204 (pam) File : nvt/fcore_2009_3204.nasl |
2009-04-15 | Name : Fedora Core 9 FEDORA-2009-3231 (pam) File : nvt/fcore_2009_3231.nasl |
2009-03-31 | Name : Mandrake Security Advisory MDVSA-2009:077 (pam) File : nvt/mdksa_2009_077.nasl |
Open Source Vulnerability Database (OSVDB)
Id | Description |
---|---|
70653 | Linux-PAM pam_xauth Module pam_xauth.c check_acl Function Special ACL File Lo... Linux-PAM contains a flaw that may allow a local denial of service. The issue is triggered when the 'check_acl' function in 'pam_xauth.c' in the 'pam_xauth' module fails to verify that a ACL file is a regular file, allowing a local user to use a special file to cause a denial of service. |
70652 | Linux-PAM pam_xauth Module pam_xauth.c pam_sm_close_session Function Arbitrar... Linux-PAM contains a flaw related to the 'pam_sm_close_session' function in 'pam_xauth.c' in the 'pam_xauth' module's failure to properly handle an inability to determine a target uid. This may allow a local attacker to delete arbitrary files via a program utilizing the pam_xauth PAM check. |
68994 | Linux-PAM pam_xauth Module run_coprocess() Function Process Limit Bypass Linux-PAM contains a flaw that may allow an attacker to gain access to unauthorized privileges. The issue is triggered when the "pam_xauth" module incorrectly checks the return values of the "setuid()" and "setgid()" functions when dropping privileges, allowing a remote attacker to gain escalated privileges. |
68993 | Linux-PAM pam_mail Module Arbitrary Mail File Enumeration Linux-PAM contains a flaw that may lead to an unauthorized information disclosure. Â The issue is triggered when an error in the 'pam_mail' module occurs when dropping privileges, which will disclose the presence of certain mail files to a local attacker. |
68992 | Linux-PAM pam_namespace Module namespace Init Script Environment Handling Loc... Linux-PAM contains a flaw that may allow an attacker to gain access to unauthorized privileges. The issue is triggered when an error in the 'pam_namespace' module when executing the namespace init script occurs, allowing a local attacker to use crafted environment variables when running a setuid program to gain elevated privileges. |
68991 | Linux-PAM pam_env Module .pam_environment File Symlink Arbitrary Local File D... Linux-PAM contains a flaw that may lead to an unauthorized information disclosure. The issue is triggered when an error in the 'pam_env' module when dropping privileges occurs, allowing a local attacker to gain access to arbitrary files by symlinking the '.pam_environment' file to a restricted file. |
53112 | Linux-PAM (pam) libpam/pam_misc.c _pam_StrTok Function Integer Signedness Wea... |
Information Assurance Vulnerability Management (IAVM)
Date | Description |
---|---|
2011-05-12 | IAVM : 2011-A-0066 - Multiple Vulnerabilities in VMware Products Severity : Category I - VMSKEY : V0027158 |
Nessus® Vulnerability Scanner
Date | Description |
---|---|
2016-03-04 | Name : The remote VMware ESX / ESXi host is missing a security-related patch. File : vmware_VMSA-2011-0004_remote.nasl - Type : ACT_GATHER_INFO |
2014-06-13 | Name : The remote openSUSE host is missing a security update. File : suse_11_3_pam-111025.nasl - Type : ACT_GATHER_INFO |
2013-07-12 | Name : The remote Oracle Linux host is missing one or more security updates. File : oraclelinux_ELSA-2010-0819.nasl - Type : ACT_GATHER_INFO |
2013-07-12 | Name : The remote Oracle Linux host is missing one or more security updates. File : oraclelinux_ELSA-2010-0891.nasl - Type : ACT_GATHER_INFO |
2012-08-01 | Name : The remote Scientific Linux host is missing one or more security updates. File : sl_20101101_pam_on_SL5_x.nasl - Type : ACT_GATHER_INFO |
2012-08-01 | Name : The remote Scientific Linux host is missing one or more security updates. File : sl_20101116_pam_on_SL6_x.nasl - Type : ACT_GATHER_INFO |
2012-06-26 | Name : The remote Gentoo host is missing one or more security-related patches. File : gentoo_GLSA-201206-31.nasl - Type : ACT_GATHER_INFO |
2011-12-13 | Name : The remote SuSE 11 host is missing one or more security updates. File : suse_11_pam-111025.nasl - Type : ACT_GATHER_INFO |
2011-12-13 | Name : The remote SuSE 10 host is missing a security-related patch. File : suse_pam-7814.nasl - Type : ACT_GATHER_INFO |
2011-11-03 | Name : The remote SuSE 10 host is missing a security-related patch. File : suse_pam-7815.nasl - Type : ACT_GATHER_INFO |
2011-06-13 | Name : The remote Ubuntu host is missing one or more security-related patches. File : ubuntu_USN-1140-2.nasl - Type : ACT_GATHER_INFO |
2011-06-13 | Name : The remote Ubuntu host is missing a security-related patch. File : ubuntu_USN-1140-1.nasl - Type : ACT_GATHER_INFO |
2011-03-08 | Name : The remote VMware ESXi / ESX host is missing one or more security-related pat... File : vmware_VMSA-2011-0004.nasl - Type : ACT_GATHER_INFO |
2010-11-24 | Name : The remote CentOS host is missing one or more security updates. File : centos_RHSA-2010-0819.nasl - Type : ACT_GATHER_INFO |
2010-11-18 | Name : The remote Fedora host is missing a security update. File : fedora_2010-17133.nasl - Type : ACT_GATHER_INFO |
2010-11-18 | Name : The remote Red Hat host is missing one or more security updates. File : redhat-RHSA-2010-0891.nasl - Type : ACT_GATHER_INFO |
2010-11-08 | Name : The remote Fedora host is missing a security update. File : fedora_2010-17155.nasl - Type : ACT_GATHER_INFO |
2010-11-05 | Name : The remote Fedora host is missing a security update. File : fedora_2010-17112.nasl - Type : ACT_GATHER_INFO |
2010-11-04 | Name : The remote Mandriva Linux host is missing one or more security updates. File : mandriva_MDVSA-2010-220.nasl - Type : ACT_GATHER_INFO |
2010-11-02 | Name : The remote Red Hat host is missing one or more security updates. File : redhat-RHSA-2010-0819.nasl - Type : ACT_GATHER_INFO |
2009-09-08 | Name : The remote Gentoo host is missing one or more security-related patches. File : gentoo_GLSA-200909-01.nasl - Type : ACT_GATHER_INFO |
2009-04-23 | Name : The remote Mandriva Linux host is missing one or more security updates. File : mandriva_MDVSA-2009-077.nasl - Type : ACT_GATHER_INFO |
2009-04-23 | Name : The remote Fedora host is missing a security update. File : fedora_2009-3204.nasl - Type : ACT_GATHER_INFO |
2009-04-15 | Name : The remote Fedora host is missing a security update. File : fedora_2009-3231.nasl - Type : ACT_GATHER_INFO |
Alert History
Date | Informations |
---|---|
2014-02-17 11:58:39 |
|