|
|
| |
|
| |
pam: multiple vulnerabilities
| Package(s): | pam |
CVE #(s): | CVE-2010-3430
CVE-2010-3431
CVE-2010-4706
|
| Created: | February 14, 2011 |
Updated: | May 31, 2011 |
| Description: |
From the Pardus advisory:
The privilege-dropping implementation in the (1) pam_env and (2)
pam_mail modules in Linux-PAM (aka pam) 1.1.2 does not perform the
required setfsgid and setgroups system calls, which might allow local
users to obtain sensitive information by leveraging unintended group
permissions, as demonstrated by a symlink attack on the .pam_environment
file in a user's home directory. NOTE: this vulnerability exists because
of an incomplete fix for CVE-2010-3435. (CVE-2010-3430)
The privilege-dropping implementation in the (1) pam_env and (2)
pam_mail modules in Linux-PAM (aka pam) 1.1.2 does not check the return
value of the setfsuid system call, which might allow local users to
obtain sensitive information by leveraging an unintended uid, as
demonstrated by a symlink attack on the .pam_environment file in a
user's home directory. NOTE: this vulnerability exists because of an
incomplete fix for CVE-2010-3435. (CVE-2010-3431)
The pam_sm_close_session function in pam_xauth.c in the pam_xauth module
in Linux-PAM (aka pam) 1.1.2 and earlier does not properly handle a
failure to determine a certain target uid, which might allow local users
to delete unintended files by executing a program that relies on the
pam_xauth PAM check. (CVE-2010-4706) |
| Alerts: |
|
( Log in to post comments)
|
|
|