---
title: CVE-2010-3430
description: Ubuntu is an open source software operating system that runs from the
  desktop, to the cloud, to all your internet connected things.
url: https://ubuntu.com/security/CVE-2010-3430
---

# CVE-2010-3430

Publication date 24 January 2011

Last updated 4 August 2025

---

Ubuntu priority

**Medium**

[Why this priority?](https://ubuntu.com/security/cves/about#priority )

Toggle side navigation

## Description

The privilege-dropping implementation in the (1) pam\_env and (2) pam\_mail
modules in Linux-PAM (aka pam) 1.1.2 does not perform the required setfsgid
and setgroups system calls, which might allow local users to obtain
sensitive information by leveraging unintended group permissions, as
demonstrated by a symlink attack on the .pam\_environment file in a user's
home directory. NOTE: this vulnerability exists because of an incomplete
fix for CVE-2010-3435.

[Read the notes from the security team](https://ubuntu.com/security/CVE-2010-3430#notes)

## Status

Show unmaintained releases

| Package | Ubuntu Release | Status |
| --- | --- | --- |
| pam | 11.04 natty | Fixed 1.1.2-2ubuntu8.2 |
| 10.10 maverick | Fixed 1.1.1-4ubuntu2.2 |
| 10.04 LTS lucid | Fixed 1.1.1-2ubuntu5.2 |
| 9.10 karmic | Ignored end of life |
| 8.04 LTS hardy | Fixed 0.99.7.1-5ubuntu6.3 |
| 6.06 LTS dapper | Ignored end of life |

---

* [How can I get the fixes?](https://ubuntu.com/security/cves/about#security)
* [What do statuses mean?](https://ubuntu.com/security/cves/about#statuses)
* [Patch details](https://ubuntu.com/security/CVE-2010-3430#patch-details)

## Notes

---

### [mdeslaur](https://launchpad.net/~mdeslaur)

see complete patch list in CVE-2010-3435

### Patch details

For informational purposes only. We recommend not to cherry-pick updates. [How can I get the fixes?](https://ubuntu.com/security/cves/about#security)

| Package | Patch details |
| --- | --- |
| pam | * Upstream:   <http://git.altlinux.org/people/ldv/packages/?p=pam.git;a=commit;h=843807a3a90f52e7538be756616510730a24739a> |

## References

* [MITRE](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-3430)
* [NVD](https://nvd.nist.gov/vuln/detail/CVE-2010-3430)
* [Launchpad](https://launchpad.net/bugs/cve/CVE-2010-3430)
* [Debian](https://security-tracker.debian.org/tracker/CVE-2010-3430)

### Related Ubuntu Security Notices (USN)

+ [USN-1140-1](https://usn.ubuntu.com/USN-1140-1)
+ PAM vulnerabilities
+ 30 May 2011

### Other references

* <https://www.cve.org/CVERecord?id=CVE-2010-3430>