CVE-2010-3316

2011-01-2418:00:01

Debian Security Bug Tracker

security-tracker.debian.org

3.3 Low

CVSS2

Attack Vector

LOCAL

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:L/AC:M/Au:N/C:P/I:P/A:N

0.0004 Low

EPSS

Percentile

10.3%

JSON

The run_coprocess function in pam_xauth.c in the pam_xauth module in Linux-PAM (aka pam) before 1.1.2 does not check the return values of the setuid, setgid, and setgroups system calls, which might allow local users to read arbitrary files by executing a program that relies on the pam_xauth PAM check.

OSVersionArchitecturePackageVersionFilename
Debian12allpam< 1.1.2-1pam_1.1.2-1_all.deb
Debian11allpam< 1.1.2-1pam_1.1.2-1_all.deb
Debian999allpam< 1.1.2-1pam_1.1.2-1_all.deb
Debian13allpam< 1.1.2-1pam_1.1.2-1_all.deb

OS	Version	Architecture	Package	Version	Filename
Debian	12	all	pam	< 1.1.2-1	pam_1.1.2-1_all.deb
Debian	11	all	pam	< 1.1.2-1	pam_1.1.2-1_all.deb
Debian	999	all	pam	< 1.1.2-1	pam_1.1.2-1_all.deb
Debian	13	all	pam	< 1.1.2-1	pam_1.1.2-1_all.deb