NVD

Id
14820  
Name
CVE-2010-3435  
Description
The (1) pam_env and (2) pam_mail modules in Linux-PAM (aka pam) before 1.1.2 use root privileges during read access to files and directories that belong to arbitrary user accounts, which might allow local users to obtain sensitive information by leveraging this filesystem activity, as demonstrated by a symlink attack on the .pam_environment file in a user"s home directory.  
Reject
 
CVSS Version
2  
CVSS Score
4.7  
Severity
Medium  
CVSS Base Score
4.7  
CVSS Impact Subscore
6.9  
CVSS Exploit Subscore
3.4  
CVSS Vector
(AV:L/AC:M/Au:N/C:C/I:N/A:N)  
Pub Date
2017-01-18  
Published
2011-01-24  
Modified Date
2012-07-23  
Seq
2010-3435  

Actions

Related NVD References

Id NVD Id NVD No. Reference Actions
82009 14820 CVE-2010-3435 http://git.altlinux.org/people/ldv/packages/?p=pam.git;a=commit;h=06f882f30092a39a1db867c9744b2ca8d60e4ad6  View
82010 14820 CVE-2010-3435 [security-announce] 20110307 VMSA-2011-0004 VMware ESX/ESXi SLPD denial of service vulnerability and ESX third party updates for Service Console packages bind, pam, and rpm  View
82011 14820 CVE-2010-3435 [oss-security] 20100921 Re: Minor security flaw with pam_xauth  View
82012 14820 CVE-2010-3435 [oss-security] 20100928 Re: Minor security flaw with pam_xauth  View
82013 14820 CVE-2010-3435 [oss-security] 20100927 Re: Minor security flaw with pam_xauth  View
82014 14820 CVE-2010-3435 [oss-security] 20100927 Re: Minor security flaw with pam_xauth  View
82015 14820 CVE-2010-3435 [oss-security] 20100928 Re: Minor security flaw with pam_xauth  View
82016 14820 CVE-2010-3435 [oss-security] 20100927 Re: Minor security flaw with pam_xauth  View
82017 14820 CVE-2010-3435 [oss-security] 20101025 Re: Minor security flaw with pam_xauth  View
82018 14820 CVE-2010-3435 GLSA-201206-31  View
82019 14820 CVE-2010-3435 MDVSA-2010:220  View
82020 14820 CVE-2010-3435 [oss-security] 20100924 Re: Minor security flaw with pam_xauth  View
82021 14820 CVE-2010-3435 RHSA-2010:0819  View
82022 14820 CVE-2010-3435 RHSA-2010:0891  View
82023 14820 CVE-2010-3435 20110308 VMSA-2011-0004 VMware ESX/ESXi SLPD denial of service vulnerability and ESX third party updates for Service Console packages bind, pam, and rpm.  View
82024 14820 CVE-2010-3435 http://www.vmware.com/security/advisories/VMSA-2011-0004.html  View
82025 14820 CVE-2010-3435 ADV-2011-0606  View
82026 14820 CVE-2010-3435 https://bugzilla.redhat.com/show_bug.cgi?id=641335  View

Related JVN

Id Name Title Summary Cveinfo Name Cveinfo Id Nvdinfo Name Nvdinfo Id Cvssv2 Cvssv3 Jvnurl Published Date Last Updated Date Actions
36967 JVNDB-2010-002747 Linux-PAM の run_coprocess 関数における任意のファイルを読まれる脆弱性 Linux-PAM の (1) pam_env および (2) pam_mail モジュールは、任意のユーザアカウントに属しているファイルおよびディレクトリに読み取りアクセスをしている間、 root 権限を使用しているため、重要な情報を取得される脆弱性が存在します。 CVE-2010-3435 46015 CVE-2010-3435 14820 4.7 http://jvndb.jvn.jp/ja/contents/2010/JVNDB-2010-002747.html 2010-11-01 2011-03-28 View