Home > Vulnerability Database > CVE-2010-3431

Mend.io Vulnerability Database

CVE-2010-3431

Date: January 24, 2011

The privilege-dropping implementation in the (1) pam_env and (2) pam_mail modules in Linux-PAM (aka pam) 1.1.2 does not check the return value of the setfsuid system call, which might allow local users to obtain sensitive information by leveraging an unintended uid, as demonstrated by a symlink attack on the .pam_environment file in a user's home directory. NOTE: this vulnerability exists because of an incomplete fix for CVE-2010-3435.

Language: C

Severity Score

2.9

Related Resources (18)

Url: http://openwall.com/lists/oss-security/2010/09/21/3

Url: https://nvd.nist.gov/vuln/detail/CVE-2010-3431

Url: http://openwall.com/lists/oss-security/2010/09/21/8

Url: http://openwall.com/lists/oss-security/2010/10/03/1

Url: http://openwall.com/lists/oss-security/2010/09/21/9

Url: http://openwall.com/lists/oss-security/2010/09/27/4

Url: http://openwall.com/lists/oss-security/2010/10/25/2

Url: http://security.gentoo.org/glsa/glsa-201206-31.xml

Url: http://www.openwall.com/lists/oss-security/2010/09/24/2

Url: http://git.altlinux.org/people/ldv/packages/?p=pam.git%3Ba=commit%3Bh=843807a3a90f52e7538be756616510730a24739a

Url: http://www.openwall.com/lists/oss-security/2010/09/21/11

Url: http://openwall.com/lists/oss-security/2010/09/27/5

Url: http://openwall.com/lists/oss-security/2010/09/27/7

Url: http://openwall.com/lists/oss-security/2010/09/21/10

Url: https://bugzilla.redhat.com/show_bug.cgi?id=641361

Url: http://openwall.com/lists/oss-security/2010/09/27/10

Url: http://secunia.com/advisories/49711

Url: https://www.mend.io/vulnerability-database/CVE-2010-3431

Severity Score

2.9

CVSS v3.1

Base Score:	2.9
Attack Vector (AV):	LOCAL
Attack Complexity (AC):	HIGH
Privileges Required (PR):	NONE
User Interaction (UI):	NONE
Scope (S):	UNCHANGED
Confidentiality (C):	LOW
Integrity (I):	NONE
Availability (A):	NONE

CVSS v2

Base Score:	1.9
Access Vector (AV):	LOCAL
Access Complexity (AC):	MEDIUM
Authentication (AU):	NONE
Confidentiality (C):	PARTIAL
Integrity (I):	NONE
Availability (A):	NONE
Additional information:

Mend.io Vulnerability Database

We found results for “”

CVE-2010-3431

Date: January 24, 2011

Language: C

Severity Score

Related Resources (18)

Severity Score

CVSS v3.1

CVSS v2

Do you need more information?