CVE-2010-3431 — Linux-pam vulnerability

9 documents7 sources
Severity
1.9LOWNVD
EPSS
0.1%
top 76.81%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
3
PAMDebian PAMLinux-pam
Timeline
PublishedJan 24
Latest updateMay 14

Description

The privilege-dropping implementation in the (1) pam_env and (2) pam_mail modules in Linux-PAM (aka pam) 1.1.2 does not check the return value of the setfsuid system call, which might allow local users to obtain sensitive information by leveraging an unintended uid, as demonstrated by a symlink attack on the .pam_environment file in a user's home directory. NOTE: this vulnerability exists because of an incomplete fix for CVE-2010-3435.

CVSS vector

AV:L/AC:M/C:P/I:N/A:NExploitability: 3.4 | Impact: 2.9

Affected Packages3 packages

▶debiandebian/pam< pam 1.1.3-1 (bookworm)
▶Debianpam/pam< 1.1.3-1+3

Patches

Patch: openwall.com ↗Patch: openwall.com ↗Patch: openwall.com ↗

🔴Vulnerability Details

2
GHSA
GHSA-65hr-mfq3-4rjr: The privilege-dropping implementation in the (1) pam_env and (2) pam_mail modules in Linux-PAM (aka pam) 1↗2022-05-14
▶
OSV
CVE-2010-3431: The privilege-dropping implementation in the (1) pam_env and (2) pam_mail modules in Linux-PAM (aka pam) 1↗2011-01-24
▶

📋Vendor Advisories

4
Ubuntu
PAM regression↗2011-05-31
▶
Ubuntu
PAM vulnerabilities↗2011-05-30
▶
Red Hat
pam: pam_mail and pam_env incorrect privilege dropping↗2010-09-21
▶
Debian
CVE-2010-3431: pam - The privilege-dropping implementation in the (1) pam_env and (2) pam_mail module...↗2010
▶

💬Community

2
Bugzilla
CVE-2010-3430 CVE-2010-3431 pam: pam_mail and pam_env incorrect privilege dropping↗2010-10-08
▶
Bugzilla
CVE-2010-3435 pam: pam_env and pam_mail accessing users' file with root privileges↗2010-10-08
▶
CVE-2010-3431 — Linux-pam vulnerability | cvebase