diff options
author | Damien Miller <djm@mindrot.org> | 2016-04-13 10:39:57 +1000 |
---|---|---|
committer | Colin Watson <cjwatson@debian.org> | 2016-04-13 08:44:57 +0100 |
commit | 7f3fb4e5fdddc6600e70ae663c21511fbcf2c64c (patch) | |
tree | ba42cc0da68c4c3c985341f87ba9b30081d4cc63 | |
parent | d888c9637031a93c13c168a35e99e9aa76c14a9a (diff) |
ignore PAM environment vars when UseLogin=yes
If PAM is configured to read user-specified environment variables
and UseLogin=yes in sshd_config, then a hostile local user may
attack /bin/login via LD_PRELOAD or similar environment variables
set via PAM.
CVE-2015-8325, found by Shayan Sadigh, via Colin Watson
Origin: upstream, https://anongit.mindrot.org/openssh.git/commit/?id=85bdcd7c92fe7ff133bbc4e10a65c91810f88755
Last-Update: 2016-04-13
Patch-Name: CVE-2015-8325.patch
-rw-r--r-- | session.c | 2 |
1 files changed, 1 insertions, 1 deletions
@@ -1317,7 +1317,7 @@ do_setup_env(Session *s, const char *shell) | |||
1317 | * Pull in any environment variables that may have | 1317 | * Pull in any environment variables that may have |
1318 | * been set by PAM. | 1318 | * been set by PAM. |
1319 | */ | 1319 | */ |
1320 | if (options.use_pam) { | 1320 | if (options.use_pam && !options.use_login) { |
1321 | char **p; | 1321 | char **p; |
1322 | 1322 | ||
1323 | p = fetch_pam_child_environment(); | 1323 | p = fetch_pam_child_environment(); |