CVE-2010-3853

Publication date 24 January 2011

Last updated 24 July 2024

Ubuntu priority

Low

Why this priority?

pam_namespace.c in the pam_namespace module in Linux-PAM (aka pam) before 1.1.3 uses the environment of the invoking application or service during execution of the namespace.init script, which might allow local users to gain privileges by running a setuid program that relies on the pam_namespace PAM check, as demonstrated by the sudo program.

Read the notes from the security team

Status

No maintained releases are affected by this CVE.

Package Ubuntu Release Status
pam 11.04 natty
Fixed 1.1.2-2ubuntu8.2
10.10 maverick
Fixed 1.1.1-4ubuntu2.2
10.04 LTS lucid
Fixed 1.1.1-2ubuntu5.2
9.10 karmic Ignored end of life
8.04 LTS hardy
Fixed 0.99.7.1-5ubuntu6.3
6.06 LTS dapper Ignored end of life

Notes

sbeattie

doesn’t look like pam_namespace is enabled by default

Patch details

For informational purposes only. We recommend not to cherry-pick updates. How can I get the fixes?

Package Patch details
pam

References

Related Ubuntu Security Notices (USN)

Other references