CVE-2019-16729

Pam-python < 1.0.7-1 local root escalation via PAM configurations

• CVSS 7.8
• CWE-269: Improper Privilege Management
• Cryptographic
• Local

pam-python before 1.0.7-1 has an issue in regard to the default environment variable handling of Python, which could allow for local root escalation in certain PAM setups.

CVE

CVE-2019-16729

CWE

CWE-269: Improper Privilege Management

CVSS base score

7.8

Published

2019-09-24

OWASP

A05 Security Misconfiguration

Orthogonal defect classification

Function

Code defect classification

Incorrect Functionality

Category

Cryptographic

Subcategory

Unencrypted communication

Accessibility scope

Local

Impact

Privilege Escalation

Fixed by upgrading

Yes

Solution

Update pam-python to version 1.0.7-1 or higher.

import os

def pam_python():
    print("Executing PAM operations with potentially unsafe environment.")

    os.system("whoami")

if __name__ == "__main__":
    pam_python()

import os
import pwd
import sys

def pam_python():
    for var in ['PYTHONPATH', 'PYTHONHOME']:
        if var in os.environ:
            del os.environ[var]

    if os.geteuid() == 0:
        username = sys.argv[1] if len(sys.argv) > 1 else 'nobody'
        user_info = pwd.getpwnam(username)
        os.setuid(user_info.pw_uid)

        print("PAM operations executed securely.")
    else:
        print("This script must be run as root.")

if __name__ == "__main__":
    pam_python()

@misc{vaitp:cve201916729,
  title        = {{Pam-python < 1.0.7-1 local root escalation via PAM configurations}},
  author       = {Bogaerts, Fr\'ed\'eric and Ivaki, Naghmeh and Fonseca, Jos\'e},
  year         = {2019},
  note         = {VAITP Python Vulnerability Dataset, entry CVE-2019-16729},
  howpublished = {\url{https://netpack.pt/vaitp/vulnerability/CVE-2019-16729/}}
}