what you don't know can hurt you

Register | Login

FilesNewsUsersAuthors

Home Files News &[SERVICES_TAB]About Contact Add New

Showing 1 - 1 of 1

Files

Mandriva Linux Security Advisory 2010-220

Posted Nov 5, 2010

Authored by Mandriva | Site mandriva.com

Mandriva Linux Security Advisory 2010-220 - The pam_xauth module did not verify the return values of the setuid() and setgid() system calls. A local, unprivileged user could use this flaw to execute the xauth command with root privileges and make it read an arbitrary input file. The pam_mail module used root privileges while accessing users' files. In certain configurations, a local, unprivileged user could use this flaw to obtain limited information about files or directories that they do not have access to. The pam_namespace module executed the external script namespace.init with an unchanged environment inherited from an application calling PAM. In cases where such an environment was untrusted (for example, when pam_namespace was configured for setuid applications such as su or sudo), a local, unprivileged user could possibly use this flaw to escalate their privileges.

tags | advisory, arbitrary, local, root

systems | linux, mandriva

advisories | CVE-2010-3316, CVE-2010-3435, CVE-2010-3853

SHA-256 | c75c1f0958b4914a5e219e8bcf5114e2f17ff93bf7a68433b923fa33342f579d

Download | Favorite | View