CVE-2010-3431

The privilege-dropping implementation in the (1) pam_env and (2) pam_mail modules in Linux-PAM (aka pam) 1.1.2 does not check the return value of the setfsuid system call, which might allow local users to obtain sensitive information by leveraging an unintended uid, as demonstrated by a symlink attack on the .pam_environment file in a user's home directory. NOTE: this vulnerability exists because of an incomplete fix for CVE-2010-3435.

• http://git.altlinux.org/people/ldv/packages/?p=pam.git%3Ba=commit%3Bh=843807a3a90f52e7538be756616510730a24739a
• http://openwall.com/lists/oss-security/2010/09/21/10Patch
• http://openwall.com/lists/oss-security/2010/09/21/3Patch
• http://openwall.com/lists/oss-security/2010/09/21/8Patch
• http://openwall.com/lists/oss-security/2010/09/21/9
• http://openwall.com/lists/oss-security/2010/09/27/10
• http://openwall.com/lists/oss-security/2010/09/27/4Patch
• http://openwall.com/lists/oss-security/2010/09/27/5
• http://openwall.com/lists/oss-security/2010/09/27/7
• http://openwall.com/lists/oss-security/2010/10/03/1Patch
• http://openwall.com/lists/oss-security/2010/10/25/2Patch
• http://secunia.com/advisories/49711
• http://security.gentoo.org/glsa/glsa-201206-31.xml
• http://www.openwall.com/lists/oss-security/2010/09/21/11Patch
• http://www.openwall.com/lists/oss-security/2010/09/24/2
• https://bugzilla.redhat.com/show_bug.cgi?id=641361Patch
• http://git.altlinux.org/people/ldv/packages/?p=pam.git%3Ba=commit%3Bh=843807a3a90f52e7538be756616510730a24739a
• http://openwall.com/lists/oss-security/2010/09/21/10Patch
• http://openwall.com/lists/oss-security/2010/09/21/3Patch
• http://openwall.com/lists/oss-security/2010/09/21/8Patch
• http://openwall.com/lists/oss-security/2010/09/21/9
• http://openwall.com/lists/oss-security/2010/09/27/10
• http://openwall.com/lists/oss-security/2010/09/27/4Patch
• http://openwall.com/lists/oss-security/2010/09/27/5
• http://openwall.com/lists/oss-security/2010/09/27/7
• http://openwall.com/lists/oss-security/2010/10/03/1Patch
• http://openwall.com/lists/oss-security/2010/10/25/2Patch
• http://secunia.com/advisories/49711
• http://security.gentoo.org/glsa/glsa-201206-31.xml
• http://www.openwall.com/lists/oss-security/2010/09/21/11Patch
• http://www.openwall.com/lists/oss-security/2010/09/24/2
• https://bugzilla.redhat.com/show_bug.cgi?id=641361Patch

Published

Jan 24, 2011

Last Modified

Jun 16, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2010-3425Cross-site scripting (XSS) vulnerability in UserControls/Pop…
• CVE-2010-3426Directory traversal vulnerability in jphone.php in the JPhon…
• CVE-2010-3427Multiple cross-site scripting (XSS) vulnerabilities in Open …
• CVE-2010-3428SQL injection vulnerability in modules/notes/json.php in Int…
• CVE-2010-3429flicvideo.c in libavcodec 0.6 and earlier in FFmpeg, as used…
• CVE-2010-3430The privilege-dropping implementation in the (1) pam_env and…
• CVE-2010-3432The sctp_packet_config function in net/sctp/output.c in the …
• CVE-2010-3433The PL/perl and PL/Tcl implementations in PostgreSQL 7.4 bef…
• CVE-2010-3434Buffer overflow in the find_stream_bounds function in pdf.c …
• CVE-2010-3435The (1) pam_env and (2) pam_mail modules in Linux-PAM (aka p…
• CVE-2010-3436fopen_wrappers.c in PHP 5.3.x through 5.3.3 might allow remo…
• CVE-2010-3437Integer signedness error in the pkt_find_dev_from_minor func…