| Vulnerability Name: | CVE-2010-0832 (CCN-60194) | ||||||||||||
| Assigned: | 2010-07-08 | ||||||||||||
| Published: | 2010-07-08 | ||||||||||||
| Updated: | 2017-08-17 | ||||||||||||
| Summary: | pam_motd (aka the MOTD module) in libpam-modules before 1.1.0-2ubuntu1.1 in PAM on Ubuntu 9.10 and libpam-modules before 1.1.1-2ubuntu5 in PAM on Ubuntu 10.04 LTS allows local users to change the ownership of arbitrary files via a symlink attack on .cache in a user's home directory, related to "user file stamps" and the motd.legal-notice file. | ||||||||||||
| CVSS v3 Severity: | 9.3 Critical (CCN CVSS v3.1 Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H)
| ||||||||||||
| CVSS v2 Severity: | 6.9 Medium (CVSS v2 Vector: AV:L/AC:M/Au:N/C:C/I:C/A:C) 5.1 Medium (Temporal CVSS v2 Vector: AV:L/AC:M/Au:N/C:C/I:C/A:C/E:U/RL:OF/RC:C)
5.3 Medium (CCN Temporal CVSS v2 Vector: AV:L/AC:L/Au:N/C:C/I:C/A:C/E:U/RL:OF/RC:C)
| ||||||||||||
| Vulnerability Type: | CWE-59 | ||||||||||||
| Vulnerability Consequences: | Gain Privileges | ||||||||||||
| References: | Source: MITRE Type: CNA CVE-2010-0832 Source: SECUNIA Type: Vendor Advisory 40512 Source: MISC Type: UNKNOWN http://twitter.com/jonoberheide/statuses/18009527979 Source: EXPLOIT-DB Type: Exploit 14273 Source: MISC Type: UNKNOWN http://www.h-online.com/security/news/item/Ubuntu-closes-root-hole-1034618.html Source: OSVDB Type: UNKNOWN 66116 Source: CCN Type: OSVDB ID: 66116 Ubuntu pam MOTD Module User File Stamps Symlink Privilege Escalation Source: BID Type: Exploit, Patch 41465 Source: CCN Type: BID-41465 PAM MOTD Module Local Privilege Escalation Vulnerability Source: CCN Type: Ubuntu Web site PAM MOTD Source: UBUNTU Type: Vendor Advisory USN-959-1 Source: VUPEN Type: Vendor Advisory ADV-2010-1747 Source: XF Type: UNKNOWN pammotd-motdlegalnotice-priv-escalation(60194) Source: XF Type: UNKNOWN pammotd-motdlegalnotice-priv-escalation(60194) Source: EXPLOIT-DB Type: EXPLOIT Offensive Security Exploit Database [07-08-2010] Source: EXPLOIT-DB Type: EXPLOIT Offensive Security Exploit Database [07-12-2010] | ||||||||||||
| Vulnerable Configuration: | Configuration 1: Configuration 2:  Denotes that component is vulnerable | ||||||||||||
| Oval Definitions | |||||||||||||
| |||||||||||||
| BACK | |||||||||||||