It looks like a user could reset an environment variable, resulting in convincing the PAM module ( running as root ) to write a file somewhere the user should not be able to write. I assume since this could allow root access, it can overwrite something that can be executed as root by another process.

Actually, from the looks of the tweet linked above, it seems to allow a user to chown an arbitrary system file so that it is owned by him, in that case the shadow file. Having access to the shadow file would allow the user to trivially reset the password for every account on the machine, including root. With that access, a user could then do just about anything to the box, and then reset the password/shadow file back to its old value/permissions so that sysadmins would be none the wiser.

Neat. Similar idea but definitely different.

Anyone care to describe how this can be used to gain root? I'm running Lucid...it'd be interesting to try the hack on myself before updating...

Just one tweet will do it ;-)

https://twitter.com/jonoberheide/status/18009527979

Works for me on Mint (a Ubuntu derivative). I'm glad I use Slackware on my production machines (no PAM).

That's incredible.

Thank you for posting this... I often ignore doing updates because they're just not as interesting as other things I'm doing. This kicked my butt into gear to install the updates.

This is important if you're running a website too - this exploit can be used to take over the machine if the hacker finds a way to execute code as the website (i.e. once they used a different exploit to break in, they would be able to escalate from www-data user to root).

I am on Ubuntu 10.04, what do I need to do besides updates and "proper" use to remain safe? I don't have an antivirus or anything of that sort!

Assuming you're still using the default package mirrors, updating is sufficient.

Is this bug restricted to ubuntu or does it affect debian/rhel etc?

I can't seem to replicate on a Debian unstable box, where pam hasn't been updated since April [0], but I don't have an Ubuntu box handy to verify that I'm properly trying to exploit it.

[0]: http://packages.qa.debian.org/p/pam.html

The security hole was introduced by a Ubuntu-specfic patch to pam. The pam_motd-legal-notice patch was added in July 2009 due to https://bugs.launchpad.net/ubuntu/+source/pam/+bug/399071

Dumb question - what's PAM? To me that means "phone as modem"...

Pluggable Authentication Modules. It's an auth framework used by many Linux distributions.

See: http://en.wikipedia.org/wiki/Pluggable_Authentication_Module... and http://en.wikipedia.org/wiki/Linux_PAM

PAM lets you among other things, define new methods of authenticating the user - for example, if I wanted to make my computer log me on whenever it saw my Bluetooth phone in range, I'd write a PAM module

It didn't work on 9.04, which I guess is good.