Bug#761600: sshd.pam: reads env variables from user file
Source: openssh
Version: 1:6.6p1-7
Severity: important
Tags: security
A few years ago CVE-2010-4708 was assigned to pam:
The pam_env module in Linux-PAM (aka pam) 1.1.2 and earlier reads the
.pam_environment file in a user's home directory, which might allow
local users to run programs with an unintended environment by executing
a program that relies on the pam_env PAM check.
This was fixed in pam by disabling user_readenv by default.
However, sshd.pam explicitly sets user_readenv=1.
user_readenv=1 might allow bypassing access restrictions (such as user
shell set to /usr/bin/rssh) even when PermitUserEnvironment is disabled.
--
Jakub Wilk
Reply to: