CVE-2010-3435
Summary
| CVE | CVE-2010-3435 |
|---|---|
| State | PUBLIC |
| Assigner | [email protected] |
| Source Priority | CVE Program / NVD first with legacy fallback |
| Published | 2011-01-24 18:00:00 UTC |
| Updated | 2023-02-13 04:24:00 UTC |
| Description | The (1) pam_env and (2) pam_mail modules in Linux-PAM (aka pam) before 1.1.2 use root privileges during read access to files and directories that belong to arbitrary user accounts, which might allow local users to obtain sensitive information by leveraging this filesystem activity, as demonstrated by a symlink attack on the .pam_environment file in a user's home directory. |
Risk And Classification
Problem Types: NVD-CWE-Other
NVD Known Affected Configurations (CPE 2.3)
| Type | Vendor | Product | Version | Update | Edition | Language |
|---|---|---|---|---|---|---|
| Application | Linux-pam | Linux-pam | 0.99.1.0 | All | All | All |
| Application | Linux-pam | Linux-pam | 0.99.10.0 | All | All | All |
| Application | Linux-pam | Linux-pam | 0.99.2.0 | All | All | All |
| Application | Linux-pam | Linux-pam | 0.99.2.1 | All | All | All |
| Application | Linux-pam | Linux-pam | 0.99.3.0 | All | All | All |
| Application | Linux-pam | Linux-pam | 0.99.4.0 | All | All | All |
| Application | Linux-pam | Linux-pam | 0.99.5.0 | All | All | All |
| Application | Linux-pam | Linux-pam | 0.99.6.0 | All | All | All |
| Application | Linux-pam | Linux-pam | 0.99.6.1 | All | All | All |
| Application | Linux-pam | Linux-pam | 0.99.6.2 | All | All | All |
| Application | Linux-pam | Linux-pam | 0.99.6.3 | All | All | All |
| Application | Linux-pam | Linux-pam | 0.99.7.0 | All | All | All |
| Application | Linux-pam | Linux-pam | 0.99.7.1 | All | All | All |
| Application | Linux-pam | Linux-pam | 0.99.8.0 | All | All | All |
| Application | Linux-pam | Linux-pam | 0.99.8.1 | All | All | All |
| Application | Linux-pam | Linux-pam | 0.99.9.0 | All | All | All |
| Application | Linux-pam | Linux-pam | 1.0.0 | All | All | All |
| Application | Linux-pam | Linux-pam | 1.0.1 | All | All | All |
| Application | Linux-pam | Linux-pam | 1.0.2 | All | All | All |
| Application | Linux-pam | Linux-pam | 1.0.3 | All | All | All |
| Application | Linux-pam | Linux-pam | 1.0.4 | All | All | All |
| Application | Linux-pam | Linux-pam | 1.1.0 | All | All | All |
| Application | Linux-pam | Linux-pam | 0.99.1.0 | All | All | All |
| Application | Linux-pam | Linux-pam | 0.99.10.0 | All | All | All |
| Application | Linux-pam | Linux-pam | 0.99.2.0 | All | All | All |
| Application | Linux-pam | Linux-pam | 0.99.2.1 | All | All | All |
| Application | Linux-pam | Linux-pam | 0.99.3.0 | All | All | All |
| Application | Linux-pam | Linux-pam | 0.99.4.0 | All | All | All |
| Application | Linux-pam | Linux-pam | 0.99.5.0 | All | All | All |
| Application | Linux-pam | Linux-pam | 0.99.6.0 | All | All | All |
| Application | Linux-pam | Linux-pam | 0.99.6.1 | All | All | All |
| Application | Linux-pam | Linux-pam | 0.99.6.2 | All | All | All |
| Application | Linux-pam | Linux-pam | 0.99.6.3 | All | All | All |
| Application | Linux-pam | Linux-pam | 0.99.7.0 | All | All | All |
| Application | Linux-pam | Linux-pam | 0.99.7.1 | All | All | All |
| Application | Linux-pam | Linux-pam | 0.99.8.0 | All | All | All |
| Application | Linux-pam | Linux-pam | 0.99.8.1 | All | All | All |
| Application | Linux-pam | Linux-pam | 0.99.9.0 | All | All | All |
| Application | Linux-pam | Linux-pam | 1.0.0 | All | All | All |
| Application | Linux-pam | Linux-pam | 1.0.1 | All | All | All |
| Application | Linux-pam | Linux-pam | 1.0.2 | All | All | All |
| Application | Linux-pam | Linux-pam | 1.0.3 | All | All | All |
| Application | Linux-pam | Linux-pam | 1.0.4 | All | All | All |
| Application | Linux-pam | Linux-pam | 1.1.0 | All | All | All |
| Application | Linux-pam | Linux-pam | All | All | All | All |
References
| Reference | Source | Link | Tags |
|---|---|---|---|
| Gentoo Linux Documentation -- Linux-PAM: Multiple vulnerabilities | GENTOO | security.gentoo.org | |
| Webmail : Solution de messagerie professionnelle - OVHcloud- OVH | VUPEN | www.vupen.com | |
| 641335 – (CVE-2010-3435) CVE-2010-3435 pam: pam_env and pam_mail accessing users' file with root privileges | CONFIRM | bugzilla.redhat.com | Patch |
| git.altlinux.org - pam.git/commit | MISC | git.altlinux.org | |
| Support / Security / Advisories / / MDVSA-2010:220 | Mandriva | MANDRIVA | www.mandriva.com | |
| rhn.redhat.com | Red Hat Support | REDHAT | www.redhat.com | |
| oss-security - Re: Minor security flaw with pam_xauth | MLIST | openwall.com | Patch |
| oss-security - Re: Minor security flaw with pam_xauth | MLIST | openwall.com | |
| oss-security - Re: Minor security flaw with pam_xauth | MLIST | www.openwall.com | |
| [Security-announce] VMSA-2011-0004 VMware ESX/ESXi SLPD denial of service vulnerability and ESX third party updates for Service Console packages bind, pam, and rpm | MLIST | lists.vmware.com | |
| rhn.redhat.com | Red Hat Support | REDHAT | www.redhat.com | |
| SecurityFocus | BUGTRAQ | www.securityfocus.com | |
| VMSA-2011-0004 | CONFIRM | www.vmware.com | |
| Security Advisory SA49711 - Gentoo update for pam - Secunia | SECUNIA | secunia.com | |
| oss-security - Re: Minor security flaw with pam_xauth | MLIST | openwall.com | Patch |
| oss-security - Re: Minor security flaw with pam_xauth | MLIST | openwall.com | Patch |
| git.altlinux.org - pam.git/commit | CONFIRM | git.altlinux.org | Patch |
| oss-security - Re: Minor security flaw with pam_xauth | MLIST | openwall.com | Patch |
| oss-security - Re: Minor security flaw with pam_xauth | MLIST | openwall.com | |
| oss-security - Re: Minor security flaw with pam_xauth | MLIST | openwall.com | Patch |
| CVE Program record | CVE.ORG | www.cve.org | canonical |
| NVD vulnerability detail | NVD | nvd.nist.gov | canonical, analysis |
No vendor comments have been submitted for this CVE.
There are currently no legacy QID mappings associated with this CVE.