PT-2011-1399 · Linux · Linux-Pam

Tomas Hoger · Publicado 2011-01-24 · Atualizado 2024-06-15 · CVE-2010-3430

Positive Technologies (AI Summary)

CVSS v2.0

4.7

Média

Vetor base

AV:L/AC:M/Au:N/C:C/I:N/A:N

Name of the Vulnerable Software and Affected Versions Linux-PAM version 1.1.2

Description The issue is related to the privilege-dropping implementation in the pam env and pam mail modules. It might allow local users to obtain sensitive information by leveraging unintended group permissions. This can be demonstrated by a symlink attack on the .pam environment file in a user's home directory.

Recommendations For Linux-PAM version 1.1.2, consider applying a patch that properly implements the setfsgid and setgroups system calls to fix the privilege-dropping issue in the pam env and pam mail modules. As a temporary workaround, restrict access to the .pam environment file to prevent symlink attacks.

Correção

Identificadores relacionados

CVE-2010-3430

OPENSUSE-SU-2024:10405-1

Produtos afetados

Linux-Pam

Referências · 28

• http://openwall.com/lists/oss-security/2010/09/21/8 · Correção
• http://openwall.com/lists/oss-security/2010/10/25/2 · Correção
• http://openwall.com/lists/oss-security/2010/10/03/1 · Correção
• https://security-tracker.debian.org/tracker/CVE-2010-3430 · Aviso do Fabricante
• http://git.altlinux.org/people/ldv/packages/?p=pam.git%3Ba=commit%3Bh=843807a3a90f52e7538be756616510730a24739a · Nota
• https://suse.com/security/cve/CVE-2011-3149 · Nota
• http://openwall.com/lists/oss-security/2010/09/27/10 · Nota
• https://suse.com/security/cve/CVE-2015-3238 · Nota
• http://openwall.com/lists/oss-security/2010/09/21/11 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2010-3430 · Nota de Segurança
• https://suse.com/security/cve/CVE-2010-3431 · Nota
• https://suse.com/security/cve/CVE-2011-3148 · Nota
• http://openwall.com/lists/oss-security/2010/09/21/3 · Correção
• https://suse.com/security/cve/CVE-2014-2583 · Nota
• https://osv.dev/vulnerability/CVE-2010-3430 · Aviso do Fabricante