CVE-2010-3435Linux-pam vulnerability

22 documents9 sources
Severity
4.7MEDIUMNVD
NVD1.9OSV1.9
EPSS
0.1%
top 75.11%
CISA KEV
Not in KEV
Exploit
No known exploits
Timeline
PublishedJan 24
Latest updateMay 14

Description

The (1) pam_env and (2) pam_mail modules in Linux-PAM (aka pam) before 1.1.2 use root privileges during read access to files and directories that belong to arbitrary user accounts, which might allow local users to obtain sensitive information by leveraging this filesystem activity, as demonstrated by a symlink attack on the .pam_environment file in a user's home directory.

CVSS vector

AV:L/AC:M/C:C/I:N/A:NExploitability: 3.4 | Impact: 6.9

Affected Packages7 packages

NVDlinux-pam/linux-pam1.1.1+23
debiandebian/pam< pam 1.1.3-1 (bookworm)
Debianpam/pam< 1.1.3-1+3

Patches

🔴Vulnerability Details

6
GHSA
GHSA-65hr-mfq3-4rjr: The privilege-dropping implementation in the (1) pam_env and (2) pam_mail modules in Linux-PAM (aka pam) 12022-05-14
GHSA
GHSA-fw5v-fh36-5x5q: The privilege-dropping implementation in the (1) pam_env and (2) pam_mail modules in Linux-PAM (aka pam) 12022-05-14
GHSA
GHSA-h8pg-g57w-hfr9: The (1) pam_env and (2) pam_mail modules in Linux-PAM (aka pam) before 12022-05-14
OSV
CVE-2010-3431: The privilege-dropping implementation in the (1) pam_env and (2) pam_mail modules in Linux-PAM (aka pam) 12011-01-24
OSV
CVE-2010-3435: The (1) pam_env and (2) pam_mail modules in Linux-PAM (aka pam) before 12011-01-24

💥Exploits & PoCs

1
Exploit-DB
RKD Software BarCode ActiveX Control 'BarCodeAx.dll' 4.9 - Remote Stack Buffer Overflow (Metasploit)2010-05-09

📋Vendor Advisories

9
Ubuntu
PAM regression2011-05-31
Ubuntu
PAM vulnerabilities2011-05-30
VMware
VMware ESX/ESXi SLPD denial of service vulnerability and ESX third party updates for Service Console packages bind, pam, and rpm.2011-03-07
Red Hat
pam: pam_mail and pam_env incorrect privilege dropping2010-09-21
Red Hat
pam: pam_mail and pam_env incorrect privilege dropping2010-09-21

💬Community

3
Bugzilla
CVE-2010-4708 pam: pam_env: reading ~/.pam_environment is security risk2011-01-25
Bugzilla
CVE-2010-3430 CVE-2010-3431 pam: pam_mail and pam_env incorrect privilege dropping2010-10-08
Bugzilla
CVE-2010-3435 pam: pam_env and pam_mail accessing users' file with root privileges2010-10-08
CVE-2010-3435 — Linux-pam vulnerability | cvebase