Linux-PAM contains a flaw that may lead to an unauthorized information disclosure.  The issue is triggered when an error in the 'pam_mail' module occurs when dropping privileges, which will disclose the presence of certain mail files to a local attacker.

Upgrade to version 1.1.3 or higher, as it has been reported to fix this vulnerability. An upgrade is required as there are no known workarounds.

• CVE ID: 2010-3435 (see also: NVD)
• Secunia Advisory ID: 42064 42088 42142 43675 44763 49711
• Related OSVDB ID: 68991 68992
• VUPEN Advisory: ADV-2011-0606
• Vendor Specific News/Changelog Entry: http://git.altlinux.org/people/ldv/packages/?p=pam.git;a=commit;h=06f882f30092a39a1db867c9744b2ca8d60e4ad6
  http://security.gentoo.org/glsa/glsa-201206-31.xml
  https://bugzilla.redhat.com/show_bug.cgi?id=641335
• Mail List Post: http://lists.vmware.com/pipermail/security-announce/2011/000126.html
• Other Advisory URL: http://openwall.com/lists/oss-security/2010/09/21/3
  http://openwall.com/lists/oss-security/2010/09/27/10
  http://openwall.com/lists/oss-security/2010/09/27/4
  http://openwall.com/lists/oss-security/2010/09/27/5
  http://openwall.com/lists/oss-security/2010/09/27/7
  http://openwall.com/lists/oss-security/2010/09/27/8
  http://openwall.com/lists/oss-security/2010/10/25/2
  http://pam.cvs.sourceforge.net/viewvc/pam/Linux-PAM/ChangeLog?revision=1.546&view=markup&pathrev=Linux-PAM-1_1_3
  http://www.mandriva.com/security/advisories?name=MDVSA-2010:220
  http://www.openwall.com/lists/oss-security/2010/09/24/2
• Vendor Specific Advisory URL: http://www.ubuntu.com/usn/usn-1140-1/
  http://www.vmware.com/security/advisories/VMSA-2011-0004.html
  https://admin.fedoraproject.org/updates/pam-1.1.1-6.fc13
• RedHat RHSA: RHSA-2010:0819 RHSA-2010:0891

• Not Available