CVE-2010-3435

pam: pam_env and pam_mail accessing users' file with root privileges

Published Jan 24, 2011 CVSS 2.0 · 4.7 Medium EPSS < 1% KEV · Not listed
Description
The (1) pam_env and (2) pam_mail modules in Linux-PAM (aka pam) before 1.1.2 use root privileges during read access to files and directories that belong to arbitrary user accounts, which might allow local users to obtain sensitive information by leveraging this filesystem activity, as demonstrated by a symlink attack on the .pam_environment file in a user's home directory.

Remediation

No solution or workaround provided in the CVE record

Tracking

Sign in to view the affected projects.

Advisories

Source ID Title
EUVD EUVD EUVD-2010-3433 The (1) pam_env and (2) pam_mail modules in Linux-PAM (aka pam) before 1.1.2 use root privileges during read access to files and directories that belong to arbitrary user accounts, which might allow local users to obtain sensitive information by leveraging this filesystem activity, as demonstrated by a symlink attack on the .pam_environment file in a user's home directory.
Ubuntu USN Ubuntu USN USN-1140-1 PAM vulnerabilities
History

No history.

Weaknesses

Sources

Status
PUBLISHED
Assigner
redhat
Published
Updated
Aug 7, 2024, 3:11 AM
Reserved
Sep 17, 2010, 12:00 AM
Status
Modified
Published
Jan 24, 2011, 6:00 PM
Modified
Jun 16, 2026, 11:22 PM
Severity
Moderate
Public date
Sep 21, 2010, 12:00 AM