Your submission was sent successfully! Close

You have successfully unsubscribed! Close

Thank you for signing up for our newsletter!
In these regular emails you will find the latest updates about Ubuntu and upcoming events where you can meet our team.Close

CVE-2010-3316

Published: 24 January 2011

The run_coprocess function in pam_xauth.c in the pam_xauth module in Linux-PAM (aka pam) before 1.1.2 does not check the return values of the setuid, setgid, and setgroups system calls, which might allow local users to read arbitrary files by executing a program that relies on the pam_xauth PAM check.

Notes

AuthorNote
mdeslaur
patch below also includes partial fix for CVE-2010-3435, but
introduces CVE-2010-3430 and CVE-2010-3431
see complete patch list in CVE-2010-3435

Priority

Low

Status

Package Release Status
pam
Launchpad, Ubuntu, Debian
dapper Ignored
(end of life)
hardy
Released (0.99.7.1-5ubuntu6.3)
karmic Ignored
(end of life)
lucid
Released (1.1.1-2ubuntu5.2)
maverick
Released (1.1.1-4ubuntu2.2)
natty Not vulnerable
(1.1.2-2ubuntu6)
upstream
Released (1.1.2)
Patches:
upstream: http://git.altlinux.org/people/ldv/packages/?p=pam.git;a=commitdiff;h=06f882f30092a39a1db867c9744b2ca8d60e4ad6 (partial)