PT-2011-1400 · Linux · Linux-Pam

Tomas Hoger · Publicado 2011-01-24 · Atualizado 2024-06-15 · CVE-2010-3431

Positive Technologies (AI Summary)

CVSS v2.0

1.9

Baixa

Vetor base

AV:L/AC:M/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions Linux-PAM version 1.1.2

Description The issue is related to the privilege-dropping implementation in the pam env and pam mail modules. It might allow local users to obtain sensitive information by leveraging an unintended uid. This can be demonstrated by a symlink attack on the .pam environment file in a user's home directory.

Recommendations For Linux-PAM version 1.1.2, consider updating to a newer version that includes a complete fix for the issue. As a temporary workaround, restrict access to the .pam environment file to minimize the risk of exploitation.

Correção

Identificadores relacionados

CVE-2010-3431

OPENSUSE-SU-2024:10405-1

Produtos afetados

Linux-Pam

Referências · 28

• http://openwall.com/lists/oss-security/2010/09/21/8 · Correção
• http://openwall.com/lists/oss-security/2010/10/25/2 · Correção
• http://openwall.com/lists/oss-security/2010/10/03/1 · Correção
• http://git.altlinux.org/people/ldv/packages/?p=pam.git%3Ba=commit%3Bh=843807a3a90f52e7538be756616510730a24739a · Nota
• https://suse.com/security/cve/CVE-2011-3149 · Nota
• http://openwall.com/lists/oss-security/2010/09/27/10 · Nota
• https://suse.com/security/cve/CVE-2015-3238 · Nota
• https://suse.com/security/cve/CVE-2010-3431 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2010-3431 · Nota de Segurança
• https://suse.com/security/cve/CVE-2011-3148 · Nota
• http://openwall.com/lists/oss-security/2010/09/21/3 · Correção
• http://openwall.com/lists/oss-security/2010/09/21/10 · Correção
• https://suse.com/security/cve/CVE-2014-2583 · Nota
• http://secunia.com/advisories/49711 · Nota
• http://openwall.com/lists/oss-security/2010/09/24/2 · Nota