Linux-PAM contains a flaw that may lead to an unauthorized information disclosure. The issue is triggered when an error in the 'pam_env' module when dropping privileges occurs, allowing a local attacker to gain access to arbitrary files by symlinking the '.pam_environment' file to a restricted file.

Upgrade to version 1.1.3 or higher, as it has been reported to fix this vulnerability. An upgrade is required as there are no known workarounds.

• CVE ID: 2010-3430 (see also: NVD) 2010-3431 (see also: NVD)
• Secunia Advisory ID: 42088 44763 49711
• Related OSVDB ID: 68992 68993
• Vendor Specific News/Changelog Entry: http://git.altlinux.org/people/ldv/packages/?p=pam.git;a=commit;h=843807a3a90f52e7538be756616510730a24739a
  http://security.gentoo.org/glsa/glsa-201206-31.xml
  https://bugzilla.redhat.com/show_bug.cgi?id=641361
• Other Advisory URL: http://openwall.com/lists/oss-security/2010/09/21/10
  http://openwall.com/lists/oss-security/2010/09/21/3
  http://openwall.com/lists/oss-security/2010/09/21/8
  http://openwall.com/lists/oss-security/2010/09/21/9
  http://openwall.com/lists/oss-security/2010/09/27/10
  http://openwall.com/lists/oss-security/2010/09/27/4
  http://openwall.com/lists/oss-security/2010/09/27/5
  http://openwall.com/lists/oss-security/2010/09/27/7
  http://openwall.com/lists/oss-security/2010/10/03/1
  http://openwall.com/lists/oss-security/2010/10/25/2
  http://pam.cvs.sourceforge.net/viewvc/pam/Linux-PAM/ChangeLog?revision=1.546&view=markup&pathrev=Linux-PAM-1_1_3
  http://www.openwall.com/lists/oss-security/2010/09/21/11
  http://www.openwall.com/lists/oss-security/2010/09/24/2
• Vendor Specific Advisory URL: http://www.ubuntu.com/usn/usn-1140-1/

• Not Available