CVE-2010-3853
pam_namespace.c in the pam_namespace module in Linux-PAM (aka pam) before 1.1.3 uses the environment of the invoking application or service during execution of the namespace.init script, which might allow local users to gain privileges by running a setuid program that relies on the pam_namespace PAM check, as demonstrated by the sudo program.
- EPSS
- 0.4% chance of exploitation in the next 30 days; higher than 35% of CVEs (scores of 2026-10-31)
- Published
- Modified
- Record from
- the NVD, synced
Affected
- linux-pam:linux-pam
References
- http://lists.vmware.com/pipermail/security-announce/2011/000126.html
- http://pam.cvs.sourceforge.net/viewvc/pam/Linux-PAM/modules/pam_namespace/pam_namespace.c?view=log#rev1.13
- http://secunia.com/advisories/49711
- http://security.gentoo.org/glsa/glsa-201206-31.xml
- http://www.mandriva.com/security/advisories?name=MDVSA-2010:220