Read the docs
TI-2010-03268 Aliases CVE-2010-3435GHSA-h8pg-g57w-hfr9

The (1) pam_env and (2) pam_mail modules in Linux-PAM (aka pam) before 1.1.2 use root…

Priority LOW 22Published · Updated

Key facts

Attack vector
Local
Privileges required
None
User interaction
— Not recorded in CVSS 2.0
Attack complexity
Medium
Impact type
—
Confidentiality · integrity · availability
Complete · None · None
Fix status
Partial Red Hat: 9 fixed, 1 without a fix

Attack profile from CVSS 2.0 · NVD. Fix status from CNA and Red Hat.

Summary

The (1) pam_env and (2) pam_mail modules in Linux-PAM (aka pam) before 1.1.2 use root privileges during read access to files and directories that belong to arbitrary user accounts, which might allow local users to obtain sensitive information by leveraging this filesystem activity, as demonstrated by a symlink attack on the .pam_environment file in a user's home directory.

Why it matters now

EPSS 0.00353 29th percentileScored 2026-11-07
Fix Partial Red Hat: 2 advisoriesRed Hat: 9 fixed, 1 without a fix

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
——all versions—No fix listedCNA
  • — Vendor— Affected all versions Fixed in — No fix listed CNA

CPE configurations NVD · 23

CPEVersionsRoleVendor
cpe:2.3:a:linux-pam:linux-pam:*:*:*:*:*:*:*:*up to 1.1.1VulnerableLinux-PAM
cpe:2.3:a:linux-pam:linux-pam:0.99.1.0:*:*:*:*:*:*:*0.99.1.0VulnerableLinux-PAM
cpe:2.3:a:linux-pam:linux-pam:0.99.2.0:*:*:*:*:*:*:*0.99.2.0VulnerableLinux-PAM
cpe:2.3:a:linux-pam:linux-pam:0.99.2.1:*:*:*:*:*:*:*0.99.2.1VulnerableLinux-PAM
cpe:2.3:a:linux-pam:linux-pam:0.99.3.0:*:*:*:*:*:*:*0.99.3.0VulnerableLinux-PAM
cpe:2.3:a:linux-pam:linux-pam:0.99.4.0:*:*:*:*:*:*:*0.99.4.0VulnerableLinux-PAM
cpe:2.3:a:linux-pam:linux-pam:0.99.5.0:*:*:*:*:*:*:*0.99.5.0VulnerableLinux-PAM
cpe:2.3:a:linux-pam:linux-pam:0.99.6.0:*:*:*:*:*:*:*0.99.6.0VulnerableLinux-PAM
cpe:2.3:a:linux-pam:linux-pam:0.99.6.1:*:*:*:*:*:*:*0.99.6.1VulnerableLinux-PAM
cpe:2.3:a:linux-pam:linux-pam:0.99.6.2:*:*:*:*:*:*:*0.99.6.2VulnerableLinux-PAM
  • cpe:2.3:a:linux-pam:linux-pam:*:*:*:*:*:*:*:* Versions up to 1.1.1 Vulnerable ·Linux-PAM
  • cpe:2.3:a:linux-pam:linux-pam:0.99.1.0:*:*:*:*:*:*:* Versions 0.99.1.0 Vulnerable ·Linux-PAM
  • cpe:2.3:a:linux-pam:linux-pam:0.99.2.0:*:*:*:*:*:*:* Versions 0.99.2.0 Vulnerable ·Linux-PAM
  • cpe:2.3:a:linux-pam:linux-pam:0.99.2.1:*:*:*:*:*:*:* Versions 0.99.2.1 Vulnerable ·Linux-PAM
  • cpe:2.3:a:linux-pam:linux-pam:0.99.3.0:*:*:*:*:*:*:* Versions 0.99.3.0 Vulnerable ·Linux-PAM
  • cpe:2.3:a:linux-pam:linux-pam:0.99.4.0:*:*:*:*:*:*:* Versions 0.99.4.0 Vulnerable ·Linux-PAM
  • cpe:2.3:a:linux-pam:linux-pam:0.99.5.0:*:*:*:*:*:*:* Versions 0.99.5.0 Vulnerable ·Linux-PAM
  • cpe:2.3:a:linux-pam:linux-pam:0.99.6.0:*:*:*:*:*:*:* Versions 0.99.6.0 Vulnerable ·Linux-PAM
  • cpe:2.3:a:linux-pam:linux-pam:0.99.6.1:*:*:*:*:*:*:* Versions 0.99.6.1 Vulnerable ·Linux-PAM
  • cpe:2.3:a:linux-pam:linux-pam:0.99.6.2:*:*:*:*:*:*:* Versions 0.99.6.2 Vulnerable ·Linux-PAM
Show 13 more CPE
CPEVersionsRoleVendor
cpe:2.3:a:linux-pam:linux-pam:0.99.6.3:*:*:*:*:*:*:*0.99.6.3VulnerableLinux-PAM
cpe:2.3:a:linux-pam:linux-pam:0.99.7.0:*:*:*:*:*:*:*0.99.7.0VulnerableLinux-PAM
cpe:2.3:a:linux-pam:linux-pam:0.99.7.1:*:*:*:*:*:*:*0.99.7.1VulnerableLinux-PAM
cpe:2.3:a:linux-pam:linux-pam:0.99.8.0:*:*:*:*:*:*:*0.99.8.0VulnerableLinux-PAM
cpe:2.3:a:linux-pam:linux-pam:0.99.8.1:*:*:*:*:*:*:*0.99.8.1VulnerableLinux-PAM
cpe:2.3:a:linux-pam:linux-pam:0.99.9.0:*:*:*:*:*:*:*0.99.9.0VulnerableLinux-PAM
cpe:2.3:a:linux-pam:linux-pam:0.99.10.0:*:*:*:*:*:*:*0.99.10.0VulnerableLinux-PAM
cpe:2.3:a:linux-pam:linux-pam:1.0.0:*:*:*:*:*:*:*1.0.0VulnerableLinux-PAM
cpe:2.3:a:linux-pam:linux-pam:1.0.1:*:*:*:*:*:*:*1.0.1VulnerableLinux-PAM
cpe:2.3:a:linux-pam:linux-pam:1.0.2:*:*:*:*:*:*:*1.0.2VulnerableLinux-PAM
cpe:2.3:a:linux-pam:linux-pam:1.0.3:*:*:*:*:*:*:*1.0.3VulnerableLinux-PAM
cpe:2.3:a:linux-pam:linux-pam:1.0.4:*:*:*:*:*:*:*1.0.4VulnerableLinux-PAM
cpe:2.3:a:linux-pam:linux-pam:1.1.0:*:*:*:*:*:*:*1.1.0VulnerableLinux-PAM
  • cpe:2.3:a:linux-pam:linux-pam:0.99.6.3:*:*:*:*:*:*:* Versions 0.99.6.3 Vulnerable ·Linux-PAM
  • cpe:2.3:a:linux-pam:linux-pam:0.99.7.0:*:*:*:*:*:*:* Versions 0.99.7.0 Vulnerable ·Linux-PAM
  • cpe:2.3:a:linux-pam:linux-pam:0.99.7.1:*:*:*:*:*:*:* Versions 0.99.7.1 Vulnerable ·Linux-PAM
  • cpe:2.3:a:linux-pam:linux-pam:0.99.8.0:*:*:*:*:*:*:* Versions 0.99.8.0 Vulnerable ·Linux-PAM
  • cpe:2.3:a:linux-pam:linux-pam:0.99.8.1:*:*:*:*:*:*:* Versions 0.99.8.1 Vulnerable ·Linux-PAM
  • cpe:2.3:a:linux-pam:linux-pam:0.99.9.0:*:*:*:*:*:*:* Versions 0.99.9.0 Vulnerable ·Linux-PAM
  • cpe:2.3:a:linux-pam:linux-pam:0.99.10.0:*:*:*:*:*:*:* Versions 0.99.10.0 Vulnerable ·Linux-PAM
  • cpe:2.3:a:linux-pam:linux-pam:1.0.0:*:*:*:*:*:*:* Versions 1.0.0 Vulnerable ·Linux-PAM
  • cpe:2.3:a:linux-pam:linux-pam:1.0.1:*:*:*:*:*:*:* Versions 1.0.1 Vulnerable ·Linux-PAM
  • cpe:2.3:a:linux-pam:linux-pam:1.0.2:*:*:*:*:*:*:* Versions 1.0.2 Vulnerable ·Linux-PAM
  • cpe:2.3:a:linux-pam:linux-pam:1.0.3:*:*:*:*:*:*:* Versions 1.0.3 Vulnerable ·Linux-PAM
  • cpe:2.3:a:linux-pam:linux-pam:1.0.4:*:*:*:*:*:*:* Versions 1.0.4 Vulnerable ·Linux-PAM
  • cpe:2.3:a:linux-pam:linux-pam:1.1.0:*:*:*:*:*:*:* Versions 1.1.0 Vulnerable ·Linux-PAM

Remediation

Red Hat 2 advisories

  • RHSA-2010:0891 Released 2010-11-16 · Red Hat rating Moderate
    pam security update
    • Red Hat Enterprise Linux Desktop (v. 6) pam-1.1.1-4.el6_0.1
    • Red Hat Enterprise Linux Desktop Optional (v. 6) pam-1.1.1-4.el6_0.1, pam-devel-1.1.1-4.el6_0.1
    • Red Hat Enterprise Linux HPC Node (v. 6) pam-1.1.1-4.el6_0.1
    • Red Hat Enterprise Linux HPC Node Optional (v. 6) pam-1.1.1-4.el6_0.1, pam-devel-1.1.1-4.el6_0.1
    • Red Hat Enterprise Linux Server (v. 6) pam-1.1.1-4.el6_0.1, pam-1.1.1-4.el6_0.1.ppc, pam-devel-1.1.1-4.el6_0.1 +1
    • Red Hat Enterprise Linux Workstation (v. 6) pam-1.1.1-4.el6_0.1, pam-devel-1.1.1-4.el6_0.1
  • RHSA-2010:0819 Released 2010-11-01 · Red Hat rating Moderate
    pam security update
    • Red Hat Enterprise Linux (v. 5 server) pam-0.99.6.2-6.el5_5.2, pam-0.99.6.2-6.el5_5.2.i386, pam-0.99.6.2-6.el5_5.2.ia64 +5
    • Red Hat Enterprise Linux Desktop (v. 5 client) pam-0.99.6.2-6.el5_5.2, pam-0.99.6.2-6.el5_5.2.i386
    • Red Hat Enterprise Linux Desktop Workstation (v. 5 client) pam-0.99.6.2-6.el5_5.2, pam-devel-0.99.6.2-6.el5_5.2, pam-devel-0.99.6.2-6.el5_5.2.i386

Vendor assessments

Red Hat

Red Hat rating: Moderate. Red Hat's page for this CVE →

ProductStatusPlan or fix
Red Hat Enterprise Linux 4AffectedNo fix planned: Will not fix
Red Hat Enterprise Linux (v. 5 server)Fixed RHSA-2010:0819
Red Hat Enterprise Linux Desktop (v. 5 client)Fixed RHSA-2010:0819
Red Hat Enterprise Linux Desktop (v. 6)Fixed RHSA-2010:0891
Red Hat Enterprise Linux Desktop Optional (v. 6)Fixed RHSA-2010:0891
Red Hat Enterprise Linux Desktop Workstation (v. 5 client)Fixed RHSA-2010:0819
Red Hat Enterprise Linux HPC Node (v. 6)Fixed RHSA-2010:0891
Red Hat Enterprise Linux HPC Node Optional (v. 6)Fixed RHSA-2010:0891
Red Hat Enterprise Linux Server (v. 6)Fixed RHSA-2010:0891
Red Hat Enterprise Linux Workstation (v. 6)Fixed RHSA-2010:0891

Timeline

  1. 2026-10-02 Threatist record created from CVE-2010-3435
  2. 2026-10-03 Alias added: GHSA-h8pg-g57w-hfr9

References

Patch 6

Advisory 4

Other 7

  • TI-2022-11097 The Linux-PAM package before 1.5.2-6.1 for openSUSE Tumbleweed allows authentication… CVSS 3.1CRITICAL 9.8
  • TI-2020-16865 Improper authentication in pam CVSS 3.1CRITICAL 9.8
  • TI-2015-02867 The _unix_run_helper_binary function in the pam_unix module in Linux-PAM (aka pam) before… CVSS 3.0MEDIUM 6.5
  • TI-2014-02069 Multiple directory traversal vulnerabilities in pam_timestamp.c in the pam_timestamp… CVSS 2.0MEDIUM 5.8
  • TI-2009-00845 Integer signedness error in the _pam_StrTok function in libpam/pam_misc.c in Linux-PAM… CVSS 2.0MEDIUM 6.6
  • TI-2010-04431 The pam_env module in Linux-PAM (aka pam) 1.1.2 and earlier reads the .pam_environment… CVSS 2.0HIGH 7.2
See all 17 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences