GCVE Workshop - 22 September 2026 (14:00-18:00), Luxembourg Before The Vulnopticon Conference - Registration

FKIE_CVE-2010-4708

Vulnerability from fkie_nvd - Published: 2011-01-24 19:00 - Updated: 2026-06-16 23:25
Severity
Summary
The pam_env module in Linux-PAM (aka pam) 1.1.2 and earlier reads the .pam_environment file in a user's home directory, which might allow local users to run programs with an unintended environment by executing a program that relies on the pam_env PAM check.
References
cve@mitre.orghttp://openwall.com/lists/oss-security/2010/09/27/7Patch
cve@mitre.orghttp://pam.cvs.sourceforge.net/viewvc/pam/Linux-PAM/modules/pam_env/pam_env.8.xml?r1=1.7&r2=1.8
cve@mitre.orghttp://pam.cvs.sourceforge.net/viewvc/pam/Linux-PAM/modules/pam_env/pam_env.c?r1=1.22&r2=1.23Patch
cve@mitre.orghttp://secunia.com/advisories/49711
cve@mitre.orghttp://security.gentoo.org/glsa/glsa-201206-31.xml
cve@mitre.orghttp://www.securityfocus.com/bid/46046
cve@mitre.orghttps://bugzilla.redhat.com/show_bug.cgi?id=641335Patch
cve@mitre.orghttps://exchange.xforce.ibmcloud.com/vulnerabilities/65037
af854a3a-2127-422b-91ae-364da2661108http://openwall.com/lists/oss-security/2010/09/27/7Patch
af854a3a-2127-422b-91ae-364da2661108http://pam.cvs.sourceforge.net/viewvc/pam/Linux-PAM/modules/pam_env/pam_env.8.xml?r1=1.7&r2=1.8
af854a3a-2127-422b-91ae-364da2661108http://pam.cvs.sourceforge.net/viewvc/pam/Linux-PAM/modules/pam_env/pam_env.c?r1=1.22&r2=1.23Patch
af854a3a-2127-422b-91ae-364da2661108http://secunia.com/advisories/49711
af854a3a-2127-422b-91ae-364da2661108http://security.gentoo.org/glsa/glsa-201206-31.xml
af854a3a-2127-422b-91ae-364da2661108http://www.securityfocus.com/bid/46046
af854a3a-2127-422b-91ae-364da2661108https://bugzilla.redhat.com/show_bug.cgi?id=641335Patch
af854a3a-2127-422b-91ae-364da2661108https://exchange.xforce.ibmcloud.com/vulnerabilities/65037
Impacted products
Vendor Product Version
linux-pam linux-pam *
linux-pam linux-pam 0.99.1.0
linux-pam linux-pam 0.99.2.0
linux-pam linux-pam 0.99.2.1
linux-pam linux-pam 0.99.3.0
linux-pam linux-pam 0.99.4.0
linux-pam linux-pam 0.99.5.0
linux-pam linux-pam 0.99.6.0
linux-pam linux-pam 0.99.6.1
linux-pam linux-pam 0.99.6.2
linux-pam linux-pam 0.99.6.3
linux-pam linux-pam 0.99.7.0
linux-pam linux-pam 0.99.7.1
linux-pam linux-pam 0.99.8.0
linux-pam linux-pam 0.99.8.1
linux-pam linux-pam 0.99.9.0
linux-pam linux-pam 0.99.10.0
linux-pam linux-pam 1.0.0
linux-pam linux-pam 1.0.1
linux-pam linux-pam 1.0.2
linux-pam linux-pam 1.0.3
linux-pam linux-pam 1.0.4
linux-pam linux-pam 1.1.0
linux-pam linux-pam 1.1.1
To clipboard 

{
  "affected": [
    {
      "affectedData": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "source": "cve@mitre.org"
    }
  ],
  "configurations": [
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:linux-pam:linux-pam:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "13C9E7AE-3FFF-4A41-BEB0-2E37B6000901",
              "versionEndIncluding": "1.1.2",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:linux-pam:linux-pam:0.99.1.0:*:*:*:*:*:*:*",
              "matchCriteriaId": "B59C70C7-FABE-4A45-A45D-2C7276D698DF",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:linux-pam:linux-pam:0.99.2.0:*:*:*:*:*:*:*",
              "matchCriteriaId": "DBA50D8F-D5A8-4123-93CF-E7714571F411",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:linux-pam:linux-pam:0.99.2.1:*:*:*:*:*:*:*",
              "matchCriteriaId": "DB8820C0-1ECB-45AD-A573-5667F0D09776",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:linux-pam:linux-pam:0.99.3.0:*:*:*:*:*:*:*",
              "matchCriteriaId": "5D416053-0010-4B25-9F7C-6054C51C1685",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:linux-pam:linux-pam:0.99.4.0:*:*:*:*:*:*:*",
              "matchCriteriaId": "B97AB578-0E9E-4370-8379-0CD455F2D740",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:linux-pam:linux-pam:0.99.5.0:*:*:*:*:*:*:*",
              "matchCriteriaId": "22A6147C-CC0A-4C9F-B9A9-E144F2133592",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:linux-pam:linux-pam:0.99.6.0:*:*:*:*:*:*:*",
              "matchCriteriaId": "6DEF8EC8-0E0A-4C0A-95BE-FB7C23732083",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:linux-pam:linux-pam:0.99.6.1:*:*:*:*:*:*:*",
              "matchCriteriaId": "C9A9AB1C-FDF8-4E98-8773-387E03CD93E1",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:linux-pam:linux-pam:0.99.6.2:*:*:*:*:*:*:*",
              "matchCriteriaId": "8F94AA92-5854-46B9-8B3C-08FCC5B071CF",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:linux-pam:linux-pam:0.99.6.3:*:*:*:*:*:*:*",
              "matchCriteriaId": "FD5C0039-827C-45CD-99BE-95459006CA59",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:linux-pam:linux-pam:0.99.7.0:*:*:*:*:*:*:*",
              "matchCriteriaId": "F4256C34-DBCA-4FE0-96A5-874D7F00869A",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:linux-pam:linux-pam:0.99.7.1:*:*:*:*:*:*:*",
              "matchCriteriaId": "1B2613D2-33C1-4132-AD9A-68190A59C0F4",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:linux-pam:linux-pam:0.99.8.0:*:*:*:*:*:*:*",
              "matchCriteriaId": "08FDE78F-119B-4FC8-BBFA-8048F2CF1227",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:linux-pam:linux-pam:0.99.8.1:*:*:*:*:*:*:*",
              "matchCriteriaId": "C4A75789-F7EC-4D9C-942A-243DF92E5CA5",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:linux-pam:linux-pam:0.99.9.0:*:*:*:*:*:*:*",
              "matchCriteriaId": "3753027E-D3A4-45D4-A3A3-2320C48AF6C6",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:linux-pam:linux-pam:0.99.10.0:*:*:*:*:*:*:*",
              "matchCriteriaId": "6533A629-6351-4831-BBF7-44718262FAF3",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:linux-pam:linux-pam:1.0.0:*:*:*:*:*:*:*",
              "matchCriteriaId": "516F23F9-25B3-40DB-A3CA-2F1DE0678934",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:linux-pam:linux-pam:1.0.1:*:*:*:*:*:*:*",
              "matchCriteriaId": "5F3ACA7F-D247-439C-8B5E-287EC5D236AF",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:linux-pam:linux-pam:1.0.2:*:*:*:*:*:*:*",
              "matchCriteriaId": "6A30E5C3-501D-4DAA-B7F7-E42F98DEDBF9",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:linux-pam:linux-pam:1.0.3:*:*:*:*:*:*:*",
              "matchCriteriaId": "AEC8C86C-9FC7-4838-BFD8-90431DEC4946",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:linux-pam:linux-pam:1.0.4:*:*:*:*:*:*:*",
              "matchCriteriaId": "EBE3BF43-7402-4CC0-A329-C8597A0758C7",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:linux-pam:linux-pam:1.1.0:*:*:*:*:*:*:*",
              "matchCriteriaId": "7A39C8AD-FA7C-4C64-AAB7-93CC461E73F2",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:linux-pam:linux-pam:1.1.1:*:*:*:*:*:*:*",
              "matchCriteriaId": "1F7BA7CC-F284-40C8-998D-FC70CCAB58D9",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "The pam_env module in Linux-PAM (aka pam) 1.1.2 and earlier reads the .pam_environment file in a user\u0027s home directory, which might allow local users to run programs with an unintended environment by executing a program that relies on the pam_env PAM check."
    },
    {
      "lang": "es",
      "value": "El modulo pam_env en Linux-PAM (tambi\u00e9n conocido como pam) v1.1.2 y anteriores lee el archivo .pam_environment en el directorio home de un usuario, lo que permite a usuarios locales ejecutar programas en un entorno no deseado ejecutando programas que conf\u00edan en la comprobaci\u00f3n pam_env PAM."
    }
  ],
  "id": "CVE-2010-4708",
  "lastModified": "2026-06-16T23:25:23.490",
  "metrics": {
    "cvssMetricV2": [
      {
        "acInsufInfo": false,
        "baseSeverity": "HIGH",
        "cvssData": {
          "accessComplexity": "LOW",
          "accessVector": "LOCAL",
          "authentication": "NONE",
          "availabilityImpact": "COMPLETE",
          "baseScore": 7.2,
          "confidentialityImpact": "COMPLETE",
          "integrityImpact": "COMPLETE",
          "vectorString": "AV:L/AC:L/Au:N/C:C/I:C/A:C",
          "version": "2.0"
        },
        "exploitabilityScore": 3.9,
        "impactScore": 10.0,
        "obtainAllPrivilege": false,
        "obtainOtherPrivilege": false,
        "obtainUserPrivilege": false,
        "source": "nvd@nist.gov",
        "type": "Primary",
        "userInteractionRequired": false
      }
    ]
  },
  "published": "2011-01-24T19:00:02.190",
  "references": [
    {
      "source": "cve@mitre.org",
      "tags": [
        "Patch"
      ],
      "url": "http://openwall.com/lists/oss-security/2010/09/27/7"
    },
    {
      "source": "cve@mitre.org",
      "url": "http://pam.cvs.sourceforge.net/viewvc/pam/Linux-PAM/modules/pam_env/pam_env.8.xml?r1=1.7\u0026r2=1.8"
    },
    {
      "source": "cve@mitre.org",
      "tags": [
        "Patch"
      ],
      "url": "http://pam.cvs.sourceforge.net/viewvc/pam/Linux-PAM/modules/pam_env/pam_env.c?r1=1.22\u0026r2=1.23"
    },
    {
      "source": "cve@mitre.org",
      "url": "http://secunia.com/advisories/49711"
    },
    {
      "source": "cve@mitre.org",
      "url": "http://security.gentoo.org/glsa/glsa-201206-31.xml"
    },
    {
      "source": "cve@mitre.org",
      "url": "http://www.securityfocus.com/bid/46046"
    },
    {
      "source": "cve@mitre.org",
      "tags": [
        "Patch"
      ],
      "url": "https://bugzilla.redhat.com/show_bug.cgi?id=641335"
    },
    {
      "source": "cve@mitre.org",
      "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/65037"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Patch"
      ],
      "url": "http://openwall.com/lists/oss-security/2010/09/27/7"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://pam.cvs.sourceforge.net/viewvc/pam/Linux-PAM/modules/pam_env/pam_env.8.xml?r1=1.7\u0026r2=1.8"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Patch"
      ],
      "url": "http://pam.cvs.sourceforge.net/viewvc/pam/Linux-PAM/modules/pam_env/pam_env.c?r1=1.22\u0026r2=1.23"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://secunia.com/advisories/49711"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://security.gentoo.org/glsa/glsa-201206-31.xml"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://www.securityfocus.com/bid/46046"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Patch"
      ],
      "url": "https://bugzilla.redhat.com/show_bug.cgi?id=641335"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/65037"
    }
  ],
  "sourceIdentifier": "cve@mitre.org",
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "NVD-CWE-Other"
        }
      ],
      "source": "nvd@nist.gov",
      "type": "Primary"
    }
  ]
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.


Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.