PAM Vulnerability in Ubuntu allowing root access

https://lists.ubuntu.com/archives/ubuntu-security-announce/2010-July/001117.html

by Kototama • 16 years ago

28 18 16 years ago

lists.ubuntu.com

rufugee• 16 years ago

Anyone care to describe how this can be used to gain root? I'm running Lucid...it'd be interesting to try the hack on myself before updating...

Kototama• 16 years ago

Just one tweet will do it ;-)

https://twitter.com/jonoberheide/status/18009527979

someone_here• 16 years ago

That's incredible.

qjz• 16 years ago

Works for me on Mint (a Ubuntu derivative). I'm glad I use Slackware on my production machines (no PAM).

openfly2• 16 years ago

It looks like a user could reset an environment variable, resulting in convincing the PAM module ( running as root ) to write a file somewhere the user should not be able to write. I assume since this could allow root access, it can overwrite something that can be executed as root by another process.

nuclear_eclipse2• 16 years ago

Actually, from the looks of the tweet linked above, it seems to allow a user to chown an arbitrary system file so that it is owned by him, in that case the shadow file. Having access to the shadow file would allow the user to trivially reset the password for every account on the machine, including root. With that access, a user could then do just about anything to the box, and then reset the password/shadow file back to its old value/permissions so that sysadmins would be none the wiser.

openfly2• 16 years ago

Neat. Similar idea but definitely different.

barnaby• 16 years ago

Thank you for posting this... I often ignore doing updates because they're just not as interesting as other things I'm doing. This kicked my butt into gear to install the updates.

xpaulbettsx2• 16 years ago

This is important if you're running a website too - this exploit can be used to take over the machine if the hacker finds a way to execute code as the website (i.e. once they used a different exploit to break in, they would be able to escalate from www-data user to root).

zokier• 16 years ago

Is this bug restricted to ubuntu or does it affect debian/rhel etc?

callahad2• 16 years ago

I can't seem to replicate on a Debian unstable box, where pam hasn't been updated since April [0], but I don't have an Ubuntu box handy to verify that I'm properly trying to exploit it.

[0] http://packages.qa.debian.org/p/pam.html

joeyh• 16 years ago

The security hole was introduced by a Ubuntu-specfic patch to pam. The pam_motd-legal-notice patch was added in July 2009 due to https://bugs.launchpad.net/ubuntu/+source/pam/+bug/399071

afhof• 16 years ago

It didn't work on 9.04, which I guess is good.

billybob• 16 years ago

Dumb question - what's PAM? To me that means "phone as modem"...

callahad2• 16 years ago

Pluggable Authentication Modules. It's an auth framework used by many Linux distributions.

See: http://en.wikipedia.org/wiki/Pluggable_Authentication_Module... and http://en.wikipedia.org/wiki/Linux_PAM

xpaulbettsx2• 16 years ago

PAM lets you among other things, define new methods of authenticating the user - for example, if I wanted to make my computer log me on whenever it saw my Bluetooth phone in range, I'd write a PAM module

poundy• 16 years ago

I am on Ubuntu 10.04, what do I need to do besides updates and "proper" use to remain safe? I don't have an antivirus or anything of that sort!

nuclear_eclipse2• 16 years ago

Assuming you're still using the default package mirrors, updating is sufficient.

PAM Vulnerability in Ubuntu allowing root access

Related Stories