A Security Vulnerability in the Solaris Kerberos PAM Module May Allow Use of a User Specified Kerberos Configuration File, Leading to Escalation of Privileges

---

A Security Vulnerability in the Solaris Kerberos PAM Module May Allow Use of a User Specified Kerberos Configuration File, Leading to Escalation of Privileges

1. Impact

A security vulnerability in the Solaris Kerberos (see kerberos(5)) pam_krb5(5) PAM module may allow a user supplied Kerberos configuration file to be used to specify realm and KDC server information, thereby allowing certain remote unprivileged users or applications to gain elevated privileges.

Sun acknowledges with thanks, Russ Allbery and Steven Luo for bringing this issue to our attention.

This issue is also described in the following documents:


2. Contributing Factors

This issue can occur in the following releases:

SPARC Platform

• SEAM (Sun Enterprise Authentication Mechanism) 1.0.1 (for Solaris 8) without patches 112237-16 and 112390-14
• Solaris 9 without patch 112908-34
• Solaris 10 without patch 138371-06
• OpenSolaris based upon build snv_01 through snv_110
  

x86 Platform

• SEAM (Sun Enterprise Authentication Mechanism) 1.0.1 (for Solaris 8) without patches 112238-15 and 112240-13
• Solaris 9 without patch 115168-19
• Solaris 10 without patch 138372-06
• OpenSolaris based upon build snv_01 through snv_110

Note: OpenSolaris distributions may include additional bug fixes above and beyond the build from which it was derived. The base build can be derived as follows:

$ uname -v
snv_101 

Note: This issue could affect all systems utilizing Kerberos via /etc/pam.conf. To determine if your system is using Kerberos thru the pam stack, the following command can be run:

$ grep pam_krb5 /etc/pam.conf | grep -v #

If any lines are returned after running this command, then the system is exposed to this vulnerability.  Example:

$ grep pam_krb5 /etc/pam.conf | grep -v #
other   auth sufficient       pam_krb5.so.1
other   account sufficient    pam_krb5.so.1
other   session optional      pam_krb5.so.1
other   password sufficient   pam_krb5.so.1

3. Symptoms

There are no predictable symptoms to indicate this issue has been exploited to gain elevated privileges.

4. Workaround

There is no workaround for this issue. Please see the Resolution section below.

5. Resolution

This issue is addressed in the following releases:

SPARC Platform

• SEAM (Sun Enterprise Authentication Mechanism) 1.0.1 (for Solaris 8) with patches 112237-16 or later and 112390-14 or later
  
• Solaris 9 with patch 112908-34 or later
  
• Solaris 10 with patch 138371-06 or later
• OpenSolaris based upon build snv_111 or later

x86 Platform

• SEAM (Sun Enterprise Authentication Mechanism) 1.0.1 (for Solaris 8) patches 112238-15 or later and 112240-13 or later
  
• Solaris 9 with patch 115168-19 or later
• Solaris 10 with patch 138372-06 or later
• OpenSolaris based upon build snv_111 or later

For more information on Security Sun Alerts, see Technical Instruction ID 213557.

This Sun Alert notification is being provided to you on an "AS IS" basis. This Sun Alert notification may contain information provided by third parties. The issues described in this Sun Alert notification may or may not impact your system(s). Sun makes no representations, warranties, or guarantees as to the information contained herein. ANY AND ALL WARRANTIES, EXPRESS OR IMPLIED, INCLUDING WITHOUT LIMITATION WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE, OR NON-INFRINGEMENT, ARE HEREBY DISCLAIMED. BY ACCESSING THIS DOCUMENT YOU ACKNOWLEDGE THAT SUN SHALL IN NO EVENT BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, PUNITIVE, OR CONSEQUENTIAL DAMAGES THAT ARISE OUT OF YOUR USE OR FAILURE TO USE THE INFORMATION CONTAINED HEREIN. This Sun Alert notification contains Sun proprietary and confidential information. It is being provided to you pursuant to the provisions of your agreement to purchase services from Sun, or, if you do not have such an agreement, the Sun.com Terms of Use. This Sun Alert notification may only be used for the purposes contemplated by these agreements.

Copyright 2000-2009 Sun Microsystems, Inc., 4150 Network Circle, Santa Clara, CA 95054 U.S.A. All rights reserved.


Modification History

05-Mar-2009: Updated Workaround section
10-Mar-2009: Updated Workaround section for IDRs
25-Mar-2009: Updated Contributing Factors and Resolution sections; issue is Resolved
21-May-2009: Updated Contributing Factors section for clarifications

Attachments

This solution has no attachment