CVE-2010-3435

EUVD-2010-3433
The (1) pam_env and (2) pam_mail modules in Linux-PAM (aka pam) before 1.1.2 use root privileges during read access to files and directories that belong to arbitrary user accounts, which might allow local users to obtain sensitive information by leveraging this filesystem activity, as demonstrated by a symlink attack on the .pam_environment file in a user's home directory.
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTPrimary
4.7 UNKNOWN
LOCAL
MEDIUM
AV:L/AC:M/Au:N/C:C/I:N/A:N
Base Score
CVSS 3.x
EPSS Score
Percentile: 18%
Affected Products (NVD)
VendorProductVersion
linux-pamlinux-pam
𝑥
≤ 1.1.1
linux-pamlinux-pam
0.99.1.0
linux-pamlinux-pam
0.99.2.0
linux-pamlinux-pam
0.99.2.1
linux-pamlinux-pam
0.99.3.0
linux-pamlinux-pam
0.99.4.0
linux-pamlinux-pam
0.99.5.0
linux-pamlinux-pam
0.99.6.0
linux-pamlinux-pam
0.99.6.1
linux-pamlinux-pam
0.99.6.2
linux-pamlinux-pam
0.99.6.3
linux-pamlinux-pam
0.99.7.0
linux-pamlinux-pam
0.99.7.1
linux-pamlinux-pam
0.99.8.0
linux-pamlinux-pam
0.99.8.1
linux-pamlinux-pam
0.99.9.0
linux-pamlinux-pam
0.99.10.0
linux-pamlinux-pam
1.0.0
linux-pamlinux-pam
1.0.1
linux-pamlinux-pam
1.0.2
linux-pamlinux-pam
1.0.3
linux-pamlinux-pam
1.0.4
linux-pamlinux-pam
1.1.0
𝑥
= Vulnerable software versions
Debian logo
Debian Releases
Debian Product
Codename
pam
bookworm
1.5.2-6+deb12u1
fixed
bullseye
1.4.0-9+deb11u1
fixed
lenny
no-dsa
sid
1.5.3-7
fixed
squeeze
no-dsa
trixie
1.5.3-7
fixed
Ubuntu logo
Ubuntu Releases
Ubuntu Product
Codename
pam
dapper
ignored
hardy
Fixed 0.99.7.1-5ubuntu6.3
released
karmic
ignored
lucid
Fixed 1.1.1-2ubuntu5.2
released
maverick
Fixed 1.1.1-4ubuntu2.2
released
natty
Fixed 1.1.2-2ubuntu8.2
released
References
http://git.altlinux.org/people/ldv/packages/?p=pam.git%3Ba=commit%3Bh=06f882f30092a39a1db867c9744b2ca8d60e4ad6
http://lists.vmware.com/pipermail/security-announce/2011/000126.html
http://openwall.com/lists/oss-security/2010/09/21/3
http://openwall.com/lists/oss-security/2010/09/27/10
http://openwall.com/lists/oss-security/2010/09/27/4
http://openwall.com/lists/oss-security/2010/09/27/5
http://openwall.com/lists/oss-security/2010/09/27/7
http://openwall.com/lists/oss-security/2010/09/27/8
http://openwall.com/lists/oss-security/2010/10/25/2
http://secunia.com/advisories/49711
http://security.gentoo.org/glsa/glsa-201206-31.xml
http://www.mandriva.com/security/advisories?name=MDVSA-2010:220
http://www.openwall.com/lists/oss-security/2010/09/24/2
http://www.redhat.com/support/errata/RHSA-2010-0819.html
http://www.redhat.com/support/errata/RHSA-2010-0891.html
http://www.securityfocus.com/archive/1/516909/100/0/threaded
http://www.vmware.com/security/advisories/VMSA-2011-0004.html
http://www.vupen.com/english/advisories/2011/0606
https://bugzilla.redhat.com/show_bug.cgi?id=641335
http://git.altlinux.org/people/ldv/packages/?p=pam.git%3Ba=commit%3Bh=06f882f30092a39a1db867c9744b2ca8d60e4ad6
http://lists.vmware.com/pipermail/security-announce/2011/000126.html
http://openwall.com/lists/oss-security/2010/09/21/3
http://openwall.com/lists/oss-security/2010/09/27/10
http://openwall.com/lists/oss-security/2010/09/27/4
http://openwall.com/lists/oss-security/2010/09/27/5
http://openwall.com/lists/oss-security/2010/09/27/7
http://openwall.com/lists/oss-security/2010/09/27/8
http://openwall.com/lists/oss-security/2010/10/25/2
http://secunia.com/advisories/49711
http://security.gentoo.org/glsa/glsa-201206-31.xml
http://www.mandriva.com/security/advisories?name=MDVSA-2010:220
http://www.openwall.com/lists/oss-security/2010/09/24/2
http://www.redhat.com/support/errata/RHSA-2010-0819.html
http://www.redhat.com/support/errata/RHSA-2010-0891.html
http://www.securityfocus.com/archive/1/516909/100/0/threaded
http://www.vmware.com/security/advisories/VMSA-2011-0004.html
http://www.vupen.com/english/advisories/2011/0606
https://bugzilla.redhat.com/show_bug.cgi?id=641335