Home > Vulnerability Database > CVE-2010-3430

Mend.io Vulnerability Database

CVE-2010-3430

Date: January 24, 2011

The privilege-dropping implementation in the (1) pam_env and (2) pam_mail modules in Linux-PAM (aka pam) 1.1.2 does not perform the required setfsgid and setgroups system calls, which might allow local users to obtain sensitive information by leveraging unintended group permissions, as demonstrated by a symlink attack on the .pam_environment file in a user's home directory. NOTE: this vulnerability exists because of an incomplete fix for CVE-2010-3435.

Language: C

Severity Score

5.1

Related Resources (18)

Url: http://openwall.com/lists/oss-security/2010/09/21/3

Url: https://nvd.nist.gov/vuln/detail/CVE-2010-3430

Url: http://openwall.com/lists/oss-security/2010/09/21/8

Url: http://openwall.com/lists/oss-security/2010/10/03/1

Url: http://openwall.com/lists/oss-security/2010/09/21/9

Url: http://openwall.com/lists/oss-security/2010/09/27/4

Url: http://openwall.com/lists/oss-security/2010/10/25/2

Url: http://security.gentoo.org/glsa/glsa-201206-31.xml

Url: http://www.openwall.com/lists/oss-security/2010/09/24/2

Url: http://git.altlinux.org/people/ldv/packages/?p=pam.git%3Ba=commit%3Bh=843807a3a90f52e7538be756616510730a24739a

Url: http://www.openwall.com/lists/oss-security/2010/09/21/11

Url: http://openwall.com/lists/oss-security/2010/09/27/5

Url: http://openwall.com/lists/oss-security/2010/09/27/7

Url: http://openwall.com/lists/oss-security/2010/09/21/10

Url: https://bugzilla.redhat.com/show_bug.cgi?id=641361

Url: http://openwall.com/lists/oss-security/2010/09/27/10

Url: http://secunia.com/advisories/49711

Url: https://www.mend.io/vulnerability-database/CVE-2010-3430

Severity Score

5.1

CVSS v3.1

Base Score:	5.1
Attack Vector (AV):	LOCAL
Attack Complexity (AC):	HIGH
Privileges Required (PR):	NONE
User Interaction (UI):	NONE
Scope (S):	UNCHANGED
Confidentiality (C):	HIGH
Integrity (I):	NONE
Availability (A):	NONE

CVSS v2

Base Score:	4.7
Access Vector (AV):	LOCAL
Access Complexity (AC):	MEDIUM
Authentication (AU):	NONE
Confidentiality (C):	COMPLETE
Integrity (I):	NONE
Availability (A):	NONE
Additional information:

Mend.io Vulnerability Database

We found results for “”

CVE-2010-3430

Date: January 24, 2011

Language: C

Severity Score

Related Resources (18)

Severity Score

CVSS v3.1

CVSS v2

Do you need more information?