CVE-2010-0832 Path traversal in n/a
Local attackers can exploit a symlink vulnerability in the PAM MOTD module to change ownership of arbitrary files, potentially leading to privilege escalation.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2010-0832?
CVE-2010-0832 is a medium-severity path traversal vulnerability in Canonical Ubuntu Linux, published on 12 Jul 2010. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
pam_motd (aka the MOTD module) in libpam-modules before 1.1.0-2ubuntu1.1 in PAM on Ubuntu 9.10 and libpam-modules before 1.1.1-2ubuntu5 in PAM on Ubuntu 10.04 LTS allows local users to change the ownership of arbitrary files via a symlink attack on .cache in a user's home directory, related to "user file stamps" and the motd.legal-notice file.
Weakness: CWE-59
Which versions are affected by CVE-2010-0832?
It affects 1 product.
Products include Canonical Ubuntu Linux.
How do I fix CVE-2010-0832?
No fix has been published for CVE-2010-0832 yet. Limit exposure of the affected software until one is available.
Upgrade, and resolve every user-supplied path against an allowed base folder before opening it. More about Path traversal.
Is CVE-2010-0832 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2010-0832 exists.
Public exploit code: 2 Exploit-DB entries and 1 proofs of concept on GitHub.
Other vulnerabilities in Canonical Ubuntu Linux
Sources
Also known as GHSA-3m5q-4mj3-9362.