Upstream information

CVE-2010-3853 at MITRE

Description

pam_namespace.c in the pam_namespace module in Linux-PAM (aka pam) before 1.1.3 uses the environment of the invoking application or service during execution of the namespace.init script, which might allow local users to gain privileges by running a setuid program that relies on the pam_namespace PAM check, as demonstrated by the sudo program.

SUSE information

Overall state of this security issue: Resolved

This issue is currently rated as having moderate severity.

CVSS v2 Scores
  National Vulnerability Database
Base Score 6.9
Vector AV:L/AC:M/Au:N/C:C/I:C/A:C
Access Vector Local
Access Complexity Medium
Authentication None
Confidentiality Impact Complete
Integrity Impact Complete
Availability Impact Complete
SUSE Bugzilla entry: 647958 [RESOLVED / FIXED]

No SUSE Security Announcements cross referenced.

List of released packages

Product(s) Fixed package version(s) References
SUSE Linux Enterprise Desktop 12
  • pam >= 1.1.8-11.57
  • pam-32bit >= 1.1.8-11.57
  • pam-doc >= 1.1.8-11.57
Patchnames:
SUSE Linux Enterprise Desktop 12 GA pam
SUSE Linux Enterprise Desktop 12 SP1
  • pam >= 1.1.8-14.1
  • pam-32bit >= 1.1.8-14.1
  • pam-doc >= 1.1.8-14.1
Patchnames:
SUSE Linux Enterprise Desktop 12 SP1 GA pam
SUSE Linux Enterprise Desktop 12 SP2
  • pam >= 1.1.8-14.1
  • pam-32bit >= 1.1.8-14.1
  • pam-doc >= 1.1.8-14.1
Patchnames:
SUSE Linux Enterprise Desktop 12 SP2 GA pam
SUSE Linux Enterprise Desktop 12 SP3
  • pam >= 1.1.8-23.1
  • pam-32bit >= 1.1.8-23.1
  • pam-doc >= 1.1.8-23.1
Patchnames:
SUSE Linux Enterprise Desktop 12 SP3 GA pam
SUSE Linux Enterprise Module for Basesystem 15
  • pam >= 1.3.0-4.10
  • pam-32bit >= 1.3.0-4.10
  • pam-devel >= 1.3.0-4.10
  • pam-doc >= 1.3.0-4.10
Patchnames:
SUSE Linux Enterprise Module for Basesystem 15 GA pam
SUSE Linux Enterprise Module for Development Tools 15
  • pam-devel-32bit >= 1.3.0-4.10
Patchnames:
SUSE Linux Enterprise Module for Development Tools 15 GA pam-devel-32bit
SUSE Linux Enterprise Server 12
  • pam >= 1.1.8-11.57
  • pam-32bit >= 1.1.8-11.57
  • pam-doc >= 1.1.8-11.57
Patchnames:
SUSE Linux Enterprise Server 12 GA pam
SUSE Linux Enterprise Server 12 SP1
  • pam >= 1.1.8-14.1
  • pam-32bit >= 1.1.8-14.1
  • pam-doc >= 1.1.8-14.1
Patchnames:
SUSE Linux Enterprise Server 12 SP1 GA pam
SUSE Linux Enterprise Server 12 SP2
  • pam >= 1.1.8-14.1
  • pam-32bit >= 1.1.8-14.1
  • pam-doc >= 1.1.8-14.1
Patchnames:
SUSE Linux Enterprise Server 12 SP2 GA pam
SUSE Linux Enterprise Server 12 SP3
  • pam >= 1.1.8-23.1
  • pam-32bit >= 1.1.8-23.1
  • pam-doc >= 1.1.8-23.1
Patchnames:
SUSE Linux Enterprise Server 12 SP3 GA pam
SUSE Linux Enterprise Server for Raspberry Pi 12 SP2
  • pam >= 1.1.8-14.1
  • pam-doc >= 1.1.8-14.1
Patchnames:
SUSE Linux Enterprise Server for Raspberry Pi 12 SP2 GA pam
SUSE Linux Enterprise Software Development Kit 12
  • pam-devel >= 1.1.8-11.57
Patchnames:
SUSE Linux Enterprise Software Development Kit 12 GA pam-devel
SUSE Linux Enterprise Software Development Kit 12 SP1
  • pam-devel >= 1.1.8-14.1
Patchnames:
SUSE Linux Enterprise Software Development Kit 12 SP1 GA pam-devel
SUSE Linux Enterprise Software Development Kit 12 SP2
  • pam-devel >= 1.1.8-14.1
Patchnames:
SUSE Linux Enterprise Software Development Kit 12 SP2 GA pam-devel
SUSE Linux Enterprise Software Development Kit 12 SP3
  • pam-devel >= 1.1.8-23.1
Patchnames:
SUSE Linux Enterprise Software Development Kit 12 SP3 GA pam-devel
openSUSE Leap 15.0
  • pam >= 1.3.0-lp150.4.6
  • pam-32bit >= 1.3.0-lp150.4.6
Patchnames:
openSUSE Leap 15.0 GA pam
openSUSE Leap 42.1
  • pam >= 1.1.8-12.4
  • pam-32bit >= 1.1.8-12.4
  • pam-devel >= 1.1.8-12.4
Patchnames:
openSUSE Leap 42.1 GA pam
openSUSE Leap 42.2
  • pam >= 1.3.0-1.9
  • pam-32bit >= 1.3.0-1.9
  • pam-devel >= 1.3.0-1.9
Patchnames:
openSUSE Leap 42.2 GA pam
openSUSE Leap 42.3
  • pam >= 1.3.0-3.15
  • pam-32bit >= 1.3.0-3.15
  • pam-devel >= 1.3.0-3.15
Patchnames:
openSUSE Leap 42.3 GA pam
openSUSE Tumbleweed
  • pam >= 1.3.0-3.4
  • pam-32bit >= 1.3.0-3.4
  • pam-devel >= 1.3.0-3.4
  • pam-devel-32bit >= 1.3.0-3.4
  • pam-doc >= 1.3.0-3.4
Patchnames:
openSUSE Tumbleweed GA pam