Description
The (1) pam_env and (2) pam_mail modules in Linux-PAM (aka pam) before 1.1.2 use root privileges during read access to files and directories that belong to arbitrary user accounts, which might allow local users to obtain sensitive information by leveraging this filesystem activity, as demonstrated by a symlink attack on the .pam_environment file in a user's home directory.
Published: 2011-01-24
Score: 4.7 Medium
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

No analysis available yet.

Remediation

No remediation available yet.

Tracking

Sign in to view the affected projects.

Advisories
Source ID Title
EUVD EUVD EUVD-2010-3433 The (1) pam_env and (2) pam_mail modules in Linux-PAM (aka pam) before 1.1.2 use root privileges during read access to files and directories that belong to arbitrary user accounts, which might allow local users to obtain sensitive information by leveraging this filesystem activity, as demonstrated by a symlink attack on the .pam_environment file in a user's home directory.
Ubuntu USN Ubuntu USN USN-1140-1 PAM vulnerabilities
History

No history.

Subscriptions

Linux-pam Linux-pam
Redhat Enterprise Linux
cve-icon MITRE

Status: PUBLISHED

Assigner: redhat

Published:

Updated: 2024-08-07T03:11:44.348Z

Reserved: 2010-09-17T00:00:00.000Z

Link: CVE-2010-3435

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Deferred

Published: 2011-01-24T18:00:02.033

Modified: 2025-04-11T00:51:21.963

Link: CVE-2010-3435

cve-icon Redhat

Severity : Moderate

Publid Date: 2010-09-21T00:00:00Z

Links: CVE-2010-3435 - Bugzilla

cve-icon OpenCVE Enrichment

No data.

Weaknesses