Vulmon Recent Vulnerabilities Research Posts Trends Blog About Contact
1.9
CVSSv2

CVE-2010-3431

Published: 24/01/2011 Updated: 07/11/2023
CVSS v2 Base Score: 1.9 | Impact Score: 2.9 | Exploitability Score: 3.4
VMScore: 169
Vector: AV:L/AC:M/Au:N/C:P/I:N/A:N

Vulnerability Summary

The privilege-dropping implementation in the (1) pam_env and (2) pam_mail modules in Linux-PAM (aka pam) 1.1.2 does not check the return value of the setfsuid system call, which might allow local users to obtain sensitive information by leveraging an unintended uid, as demonstrated by a symlink attack on the .pam_environment file in a user's home directory. NOTE: this vulnerability exists because of an incomplete fix for CVE-2010-3435.

Vulnerability Trend

Vulnerable Product Search on Vulmon Subscribe to Product

linux-pam linux-pam 1.1.2

Vendor Advisories

Ubuntu Security Notice: pam regression
The USN-1140-1 PAM update caused cron to stop working ...
Ubuntu Security Notice: pam vulnerabilities
An attacker could cause PAM to read or delete arbitrary files or cause it to crash ...
Debian CVElist Bug Report Logs: CVE-2010-3316 CVE-2010-3430 CVE-2010-3431 CVE-2010-3435
Debian Bug report logs - #599832 CVE-2010-3316 CVE-2010-3430 CVE-2010-3431 CVE-2010-3435 Package: pam; Maintainer for pam is Steve Langasek <vorlon@debianorg>; Reported by: Moritz Muehlenhoff <jmm@debianorg> Date: Mon, 11 Oct 2010 17:54:05 UTC Severity: important Tags: security Fixed in version pam/113-1 Done: ...
Debian CVElist Bug Report Logs: CVE-2010-3853: pam_namespace executes namespace.init with service's environment
Debian Bug report logs - #608273 CVE-2010-3853: pam_namespace executes namespaceinit with service's environment Package: pam; Maintainer for pam is Steve Langasek <vorlon@debianorg>; Reported by: Giuseppe Iuculano <iuculano@debianorg> Date: Wed, 29 Dec 2010 15:18:02 UTC Severity: serious Tags: patch, security Fix ...

References

NVD-CWE-Otherhttp://openwall.com/lists/oss-security/2010/09/27/4http://openwall.com/lists/oss-security/2010/09/21/3http://openwall.com/lists/oss-security/2010/09/21/9http://openwall.com/lists/oss-security/2010/10/25/2http://openwall.com/lists/oss-security/2010/09/21/10http://openwall.com/lists/oss-security/2010/09/27/5http://www.openwall.com/lists/oss-security/2010/09/21/11http://openwall.com/lists/oss-security/2010/09/27/7https://bugzilla.redhat.com/show_bug.cgi?id=641361http://www.openwall.com/lists/oss-security/2010/09/24/2http://openwall.com/lists/oss-security/2010/09/21/8http://openwall.com/lists/oss-security/2010/09/27/10http://openwall.com/lists/oss-security/2010/10/03/1http://security.gentoo.org/glsa/glsa-201206-31.xmlhttp://secunia.com/advisories/49711http://git.altlinux.org/people/ldv/packages/?p=pam.git%3Ba=commit%3Bh=843807a3a90f52e7538be756616510730a24739ahttps://nvd.nist.govhttps://usn.ubuntu.com/1140-2/
VMScore
CVSSv2
CVSSv3
VMScore
Recommendations:
CVE-2023-30310CVE-2024-21683CVE-2024-22187chromedeserializationXPath injectionCVE-2024-27842denial of serviceCVE-2024-24851googleCVE-2024-35400
Vulnerability Notification Service
You don’t have to wait for vulnerability scanning results
Get Started

Vulmon Search

Vulmon Search is a vulnerability search engine. It gives comprehensive vulnerability information through a very simple user interface.

About

Home Recent Vulnerabilities Research Posts Trends Blog About Contact

Products

Vulmon Search Vulmon Research Vulmon Alerts Vulmap

Connect

Twitter Reddit Linkedin Facebook