CVE-2010-3430: Medium severity Linux-PAM Linux-PAM vulnerability
The pammail and pamenv modules in Linux-PAM before 1.1.2 did not drop privileges before accessing users' files (CVE-2010-3435, see bug #641335). Privilege dropping was added in 1.1.2, but with couple of issues pointed out by Solar Designer:
http://thread.gmane.org/gmane.comp.security.oss.general/3311/focus=3534
The code fails to switch fsgid/egid and groups (CVE-2010-3430) and does not check setfsuid() return value (CVE-2010-3431). Fix using newly-introduced pammodutildroppriv / pammodutilregainpriv was committed in upstream CVS and should be included in 1.1.3: http://git.altlinux.org/people/ldv/packages/?p=pam.git;a=commitdiff;h=843807a3a90f52e7538be756616510730a24739a
Other sources
The privilege-dropping implementation in the (1) pamenv and (2) pammail modules in Linux-PAM (aka pam) 1.1.2 does not perform the required setfsgid and setgroups system calls, which might allow local users to obtain sensitive information by leveraging unintended group permissions, as demonstrated by a symlink attack on the .pamenvironment file in a user's home directory. NOTE: this vulnerability exists because of an incomplete fix for CVE-2010-3435.
Affected Software
Remediation
Patch Available
Patch Available
Patch Available
Patch Available
Patch Available
Patch Available
Patch Available
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2010-3430?
CVE-2010-3430 is considered a medium severity vulnerability due to its potential to expose user files.
How do I fix CVE-2010-3430?
To fix CVE-2010-3430, upgrade to Linux-PAM version 1.1.2 or later.
What systems are affected by CVE-2010-3430?
CVE-2010-3430 affects Linux-PAM versions prior to 1.1.2.
What impact does CVE-2010-3430 have?
CVE-2010-3430 can lead to unauthorized access to user files due to privilege escalation.
Is CVE-2010-3430 exploitable?
Yes, CVE-2010-3430 can be exploited by local attackers to gain access to sensitive user files.