CVE-2010-4708
published 2011-01-24CVE-2010-4708: The pam_env module in Linux-PAM (aka pam) 1.1.2 and earlier reads the .pam_environment file in a user's home directory, which might allow local users to run…
PriorityP423high7.2CVSS 2.0
AVLACLAuNCCICAC
EPSS
0.37%
29.0th percentile
The pam_env module in Linux-PAM (aka pam) 1.1.2 and earlier reads the .pam_environment file in a user's home directory, which might allow local users to run programs with an unintended environment by executing a program that relies on the pam_env PAM check.
Affected
29 ranges· showing 25
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | pam | < pam 1.1.3-7.1 (bookworm) | pam 1.1.3-7.1 (bookworm) |
| linux-pam | linux-pam | <= 1.1.2 | — |
| linux-pam | linux-pam | — | — |
| linux-pam | linux-pam | — | — |
| linux-pam | linux-pam | — | — |
| linux-pam | linux-pam | — | — |
| linux-pam | linux-pam | — | — |
| linux-pam | linux-pam | — | — |
| linux-pam | linux-pam | — | — |
| linux-pam | linux-pam | — | — |
| linux-pam | linux-pam | — | — |
| linux-pam | linux-pam | — | — |
| linux-pam | linux-pam | — | — |
| linux-pam | linux-pam | — | — |
| linux-pam | linux-pam | — | — |
| linux-pam | linux-pam | — | — |
| linux-pam | linux-pam | — | — |
| linux-pam | linux-pam | — | — |
| linux-pam | linux-pam | — | — |
| linux-pam | linux-pam | — | — |
| linux-pam | linux-pam | — | — |
| linux-pam | linux-pam | — | — |
| linux-pam | linux-pam | — | — |
| linux-pam | linux-pam | — | — |
| linux-pam | linux-pam | — | — |
CVSS provenance
nvdv2.07.2HIGHAV:L/AC:L/Au:N/C:C/I:C/A:C
osv7.2HIGH
vendor_debian7.2LOW
vendor_redhat7.2HIGH
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Red Hat
pam: pam_env: reading ~/.pam_environment is security risk
vendor_redhat·2010-09-27·CVSS 7.2
CVE-2010-4708 [HIGH] pam: pam_env: reading ~/.pam_environment is security risk
pam: pam_env: reading ~/.pam_environment is security risk
The pam_env module in Linux-PAM (aka pam) 1.1.2 and earlier reads the .pam_environment file in a user's home directory, which might allow local users to run programs with an unintended environment by executing a program that relies on the pam_env PAM check.
Package: pam (Red Hat Enterprise Linux 4) - Not affected
Package: pam (Red Hat Enterprise Linux 5) - Not affected
Debian
CVE-2010-4708: pam - The pam_env module in Linux-PAM (aka pam) 1.1.2 and earlier reads the .pam_envir...
vendor_debian·2010·CVSS 7.2
CVE-2010-4708 [HIGH] CVE-2010-4708: pam - The pam_env module in Linux-PAM (aka pam) 1.1.2 and earlier reads the .pam_envir...
The pam_env module in Linux-PAM (aka pam) 1.1.2 and earlier reads the .pam_environment file in a user's home directory, which might allow local users to run programs with an unintended environment by executing a program that relies on the pam_env PAM check.
Scope: local
bookworm: resolved (fixed in 1.1.3-7.1)
bullseye: resolved (fixed in 1.1.3-7.1)
forky: resolved (fixed in 1.1.3-7.1)
sid: resolved (fixed in 1.1.3-7.1)
trixie: resolved (fixed in 1.1.3-7.1)
GHSA
GHSA-77qw-jxwx-7hx3: The pam_env module in Linux-PAM (aka pam) 1
ghsa_unreviewed·2022-05-14
CVE-2010-4708 [HIGH] GHSA-77qw-jxwx-7hx3: The pam_env module in Linux-PAM (aka pam) 1
The pam_env module in Linux-PAM (aka pam) 1.1.2 and earlier reads the .pam_environment file in a user's home directory, which might allow local users to run programs with an unintended environment by executing a program that relies on the pam_env PAM check.
OSV
CVE-2010-4708: The pam_env module in Linux-PAM (aka pam) 1
osv·2011-01-24·CVSS 7.2
CVE-2010-4708 [HIGH] CVE-2010-4708: The pam_env module in Linux-PAM (aka pam) 1
The pam_env module in Linux-PAM (aka pam) 1.1.2 and earlier reads the .pam_environment file in a user's home directory, which might allow local users to run programs with an unintended environment by executing a program that relies on the pam_env PAM check.
No detection rules found.
No public exploits indexed.
http://openwall.com/lists/oss-security/2010/09/27/7http://pam.cvs.sourceforge.net/viewvc/pam/Linux-PAM/modules/pam_env/pam_env.8.xml?r1=1.7&r2=1.8http://pam.cvs.sourceforge.net/viewvc/pam/Linux-PAM/modules/pam_env/pam_env.c?r1=1.22&r2=1.23http://secunia.com/advisories/49711http://security.gentoo.org/glsa/glsa-201206-31.xmlhttp://www.securityfocus.com/bid/46046https://bugzilla.redhat.com/show_bug.cgi?id=641335https://exchange.xforce.ibmcloud.com/vulnerabilities/65037http://openwall.com/lists/oss-security/2010/09/27/7http://pam.cvs.sourceforge.net/viewvc/pam/Linux-PAM/modules/pam_env/pam_env.8.xml?r1=1.7&r2=1.8http://pam.cvs.sourceforge.net/viewvc/pam/Linux-PAM/modules/pam_env/pam_env.c?r1=1.22&r2=1.23http://secunia.com/advisories/49711http://security.gentoo.org/glsa/glsa-201206-31.xmlhttp://www.securityfocus.com/bid/46046https://bugzilla.redhat.com/show_bug.cgi?id=641335https://exchange.xforce.ibmcloud.com/vulnerabilities/65037
2011-01-24
Published