CVE-2010-3435

The (1) pam_env and (2) pam_mail modules in Linux-PAM (aka pam) before 1.1.2 use root privileges during read access to files and directories that belong to arbitrary user accounts, which might allow local users to obtain sensitive information by leveraging this filesystem activity, as demonstrated by a symlink attack on the .pam_environment file in a user's home directory.
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTNIST
4.7 UNKNOWN
LOCAL
MEDIUM
AV:L/AC:M/Au:N/C:C/I:N/A:N
redhatCNA
---
---
CVEADP
---
---
Base Score
CVSS 3.x
EPSS Score
Percentile: 26%
VendorProductVersion
linux-pamlinux-pam
𝑥
≤ 1.1.1
linux-pamlinux-pam
0.99.1.0
linux-pamlinux-pam
0.99.2.0
linux-pamlinux-pam
0.99.2.1
linux-pamlinux-pam
0.99.3.0
linux-pamlinux-pam
0.99.4.0
linux-pamlinux-pam
0.99.5.0
linux-pamlinux-pam
0.99.6.0
linux-pamlinux-pam
0.99.6.1
linux-pamlinux-pam
0.99.6.2
linux-pamlinux-pam
0.99.6.3
linux-pamlinux-pam
0.99.7.0
linux-pamlinux-pam
0.99.7.1
linux-pamlinux-pam
0.99.8.0
linux-pamlinux-pam
0.99.8.1
linux-pamlinux-pam
0.99.9.0
linux-pamlinux-pam
0.99.10.0
linux-pamlinux-pam
1.0.0
linux-pamlinux-pam
1.0.1
linux-pamlinux-pam
1.0.2
linux-pamlinux-pam
1.0.3
linux-pamlinux-pam
1.0.4
linux-pamlinux-pam
1.1.0
𝑥
= Vulnerable software versions
Debian logo
Debian Releases
Debian Product
Codename
pam
bullseye
1.4.0-9+deb11u1
fixed
squeeze
no-dsa
lenny
no-dsa
bookworm
1.5.2-6+deb12u1
fixed
sid
1.5.3-7
fixed
trixie
1.5.3-7
fixed
Ubuntu logo
Ubuntu Releases
Ubuntu Product
Codename
pam
natty
Fixed 1.1.2-2ubuntu8.2
released
maverick
Fixed 1.1.1-4ubuntu2.2
released
lucid
Fixed 1.1.1-2ubuntu5.2
released
karmic
ignored
hardy
Fixed 0.99.7.1-5ubuntu6.3
released
dapper
ignored
References
http://git.altlinux.org/people/ldv/packages/?p=pam.git%3Ba=commit%3Bh=06f882f30092a39a1db867c9744b2ca8d60e4ad6
http://lists.vmware.com/pipermail/security-announce/2011/000126.html
http://openwall.com/lists/oss-security/2010/09/21/3
http://openwall.com/lists/oss-security/2010/09/27/10
http://openwall.com/lists/oss-security/2010/09/27/4
http://openwall.com/lists/oss-security/2010/09/27/5
http://openwall.com/lists/oss-security/2010/09/27/7
http://openwall.com/lists/oss-security/2010/09/27/8
http://openwall.com/lists/oss-security/2010/10/25/2
http://secunia.com/advisories/49711
http://security.gentoo.org/glsa/glsa-201206-31.xml
http://www.mandriva.com/security/advisories?name=MDVSA-2010:220
http://www.openwall.com/lists/oss-security/2010/09/24/2
http://www.redhat.com/support/errata/RHSA-2010-0819.html
http://www.redhat.com/support/errata/RHSA-2010-0891.html
http://www.securityfocus.com/archive/1/516909/100/0/threaded
http://www.vmware.com/security/advisories/VMSA-2011-0004.html
http://www.vupen.com/english/advisories/2011/0606
https://bugzilla.redhat.com/show_bug.cgi?id=641335
http://git.altlinux.org/people/ldv/packages/?p=pam.git%3Ba=commit%3Bh=06f882f30092a39a1db867c9744b2ca8d60e4ad6
http://lists.vmware.com/pipermail/security-announce/2011/000126.html
http://openwall.com/lists/oss-security/2010/09/21/3
http://openwall.com/lists/oss-security/2010/09/27/10
http://openwall.com/lists/oss-security/2010/09/27/4
http://openwall.com/lists/oss-security/2010/09/27/5
http://openwall.com/lists/oss-security/2010/09/27/7
http://openwall.com/lists/oss-security/2010/09/27/8
http://openwall.com/lists/oss-security/2010/10/25/2
http://secunia.com/advisories/49711
http://security.gentoo.org/glsa/glsa-201206-31.xml
http://www.mandriva.com/security/advisories?name=MDVSA-2010:220
http://www.openwall.com/lists/oss-security/2010/09/24/2
http://www.redhat.com/support/errata/RHSA-2010-0819.html
http://www.redhat.com/support/errata/RHSA-2010-0891.html
http://www.securityfocus.com/archive/1/516909/100/0/threaded
http://www.vmware.com/security/advisories/VMSA-2011-0004.html
http://www.vupen.com/english/advisories/2011/0606
https://bugzilla.redhat.com/show_bug.cgi?id=641335