Russ Allbery pam-krb5 before 3.13, as used by libpam-heimdal, su in Solaris 10, and other software, does not properly handle calls to pam_setcred when running setuid, which allows local users to overwrite and change the ownership of arbitrary files by setting the KRB5CCNAME environment variable, and then launching a setuid application that performs certain pam_setcred operations.

The remote host is affected by the vulnerability described in GLSA-201412-08 (Multiple packages, Multiple vulnerabilities fixed in 2010)

    Vulnerabilities have been discovered in the packages listed below.
      Please review the CVE identifiers in the Reference section for details.
      Insight       Perl Tk Module       Source-Navigator       Tk       Partimage       Mlmmj       acl       Xinit       gzip       ncompress       liblzw       splashutils       GNU M4       KDE Display Manager       GTK+       KGet       dvipng       Beanstalk       Policy Mount       pam_krb5       GNU gv       LFTP       Uzbl       Slim       Bitdefender Console       iputils       DVBStreamer   Impact :

    A context-dependent attacker may be able to gain escalated privileges,       execute arbitrary code, cause Denial of Service, obtain sensitive       information, or otherwise bypass security restrictions.
  Workaround :

    There are no known workarounds at this time.

It was discovered that pam_krb5 parsed environment variables when run with setuid applications. A local attacker could exploit this flaw to bypass authentication checks and gain root privileges. (CVE-2009-0360)

Derek Chan discovered that pam_krb5 incorrectly handled refreshing existing credentials when used with setuid applications. A local attacker could exploit this to create or overwrite arbitrary files, and possibly gain root privileges. (CVE-2009-0361).

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote host is affected by the vulnerability described in GLSA-200903-39 (pam_krb5: Privilege escalation)

    The following vulnerabilities were discovered:
    pam_krb5     does not properly initialize the Kerberos libraries for setuid use     (CVE-2009-0360).
    Derek Chan reported that calls to     pam_setcred() are not properly handled when running setuid     (CVE-2009-0361).
  Impact :

    A local attacker could set an environment variable to point to a     specially crafted Kerberos configuration file and launch a PAM-based     setuid application to elevate privileges, or change ownership and     overwrite arbitrary files.
  Workaround :

    There is no known workaround at this time.

Derek Chan discovered that the PAM module for the Heimdal Kerberos implementation allows reinitialisation of user credentials when run from a setuid context, resulting in potential local denial of service by overwriting the credential cache file or to local privilege escalation.

Several local vulnerabilities have been discovered in the PAM module for MIT Kerberos. The Common Vulnerabilities and Exposures project identifies the following problems :

  - CVE-2009-0360     Russ Allbery discovered that the Kerberos PAM module     parsed configuration settings from environment variables     when run from a setuid context. This could lead to local     privilege escalation if an attacker points a setuid     program using PAM authentication to a Kerberos setup     under her control.

  - CVE-2009-0361     Derek Chan discovered that the Kerberos PAM module     allows reinitialisation of user credentials when run     from a setuid context, resulting in potential local     denial of service by overwriting the credential cache     file or to privilege escalation.

SunOS 5.9_x86: krb5, gss patch.
Date this patch was last updated by Sun : Sep/14/10

SunOS 5.9: krb5, gss patch.
Date this patch was last updated by Sun : Sep/14/10

ID	Name	Product	Family	Type	Severity
79961	GLSA-201412-08 : Multiple packages, Multiple vulnerabilities fixed in 2010	Nessus	Gentoo Local Security Checks	Local	critical
36218	Ubuntu 8.04 LTS / 8.10 : libpam-krb5 vulnerabilities (USN-719-1)	Nessus	Ubuntu Local Security Checks	Local	medium
36027	GLSA-200903-39 : pam_krb5: Privilege escalation	Nessus	Gentoo Local Security Checks	Local	medium
35663	Debian DSA-1722-1 : libpam-heimdal - programming error	Nessus	Debian Local Security Checks	Local	medium
35662	Debian DSA-1721-1 : libpam-krb5 - several vulnerabilities	Nessus	Debian Local Security Checks	Local	medium
13620	Solaris 9 (x86) : 115168-24	Nessus	Solaris Local Security Checks	Local	critical
13520	Solaris 9 (sparc) : 112908-38	Nessus	Solaris Local Security Checks	Local	critical

Detections

Analytics

CVE-2009-0361

medium

Tenable Plugins

critical

medium

medium

medium

medium

critical

critical