CVE-2010-3435: Medium severity Linux-PAM Linux-PAM vulnerability
It was reported that pamenv and pammail modules do not drop privileges before accessing users' files. This flaw can lead to information disclosure.
Issue was partially addressed in Linux-PAM 1.1.2: http://git.altlinux.org/people/ldv/packages/?p=pam.git;a=commitdiff;h=06f882f30092a39a1db867c9744b2ca8d60e4ad6
The fix in 1.1.2 has some problems though, it fails to switch fsgid/egid and groups (CVE-2010-3430) and does not check setfsuid() return value (CVE-2010-3431): http://thread.gmane.org/gmane.comp.security.oss.general/3311/focus=3551
Fix using newly-introduced pammodutildroppriv / pammodutilregainpriv was committed in upstream CVS and should be included in 1.1.3: http://git.altlinux.org/people/ldv/packages/?p=pam.git;a=commitdiff;h=843807a3a90f52e7538be756616510730a24739a
Acknowledgements:
Red Hat would like to thank Sebastian Krahmer of the SuSE Security Team for reporting this issue.
Other sources
The (1) pamenv and (2) pammail modules in Linux-PAM (aka pam) before 1.1.2 use root privileges during read access to files and directories that belong to arbitrary user accounts, which might allow local users to obtain sensitive information by leveraging this filesystem activity, as demonstrated by a symlink attack on the .pamenvironment file in a user's home directory.
Affected Software
Remediation
Patch Available
Patch Available
Patch Available
Patch Available
Patch Available
Patch Available
Event History
Parent advisories
This vulnerability appears in the following advisories.
Frequently Asked Questions
What is the severity of CVE-2010-3435?
CVE-2010-3435 has a moderate severity due to the potential for information disclosure.
How do I fix CVE-2010-3435?
To remediate CVE-2010-3435, upgrade to the patched version of the pam package that addresses this vulnerability.
What modules are affected by CVE-2010-3435?
The pam_env and pam_mail modules are affected by CVE-2010-3435, leading to privilege escalation risks.
Which versions of pam are vulnerable to CVE-2010-3435?
Versions of pam before 0:0.99.6.2-6.el5_5.2 and 0:1.1.1-4.el6_0.1 are vulnerable to CVE-2010-3435.
Is CVE-2010-3435 specific to any Linux distribution?
CVE-2010-3435 primarily affects Red Hat-based distributions due to vulnerabilities in the pam package.