#VU45416 Input validation error in linux-pam - CVE-2010-3430
Vulnerability identifier: #VU45416
Vulnerability risk: Medium
CVSSv4.0: 4.6 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:U/U:Green]
CVE-ID:
CWE-ID:
CWE-20
Exploitation vector: Network
Exploit availability: No
Vulnerable software:
linux-pam
Other software /
Other software solutions
Vendor: git.kernel.org
Description
The vulnerability allows a remote non-authenticated attacker to gain access to sensitive information.
The privilege-dropping implementation in the (1) pam_env and (2) pam_mail modules in Linux-PAM (aka pam) 1.1.2 does not perform the required setfsgid and setgroups system calls, which might allow local users to obtain sensitive information by leveraging unintended group permissions, as demonstrated by a symlink attack on the .pam_environment file in a user's home directory. NOTE: this vulnerability exists because of an incomplete fix for CVE-2010-3435.
Mitigation
Install update from vendor's website.
Vulnerable software versions
linux-pam: 1.1.2
External links
https://git.altlinux.org/people/ldv/packages/?p=pam.git;a=commit;h=843807a3a90f52e7538be756616510730a24739a
https://openwall.com/lists/oss-security/2010/09/21/10
https://openwall.com/lists/oss-security/2010/09/21/3
https://openwall.com/lists/oss-security/2010/09/21/8
https://openwall.com/lists/oss-security/2010/09/21/9
https://openwall.com/lists/oss-security/2010/09/27/10
https://openwall.com/lists/oss-security/2010/09/27/4
https://openwall.com/lists/oss-security/2010/09/27/5
https://openwall.com/lists/oss-security/2010/09/27/7
https://openwall.com/lists/oss-security/2010/10/03/1
https://openwall.com/lists/oss-security/2010/10/25/2
https://secunia.com/advisories/49711
https://security.gentoo.org/glsa/glsa-201206-31.xml
https://www.openwall.com/lists/oss-security/2010/09/21/11
https://www.openwall.com/lists/oss-security/2010/09/24/2
https://bugzilla.redhat.com/show_bug.cgi?id=641361
Q & A
Can this vulnerability be exploited remotely?
Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability.
