cve-2009-0360
Vulnerability from cvelistv5
Published
2009-02-13 17:00
Modified
2024-08-07 04:31
Severity ?
Summary
Russ Allbery pam-krb5 before 3.13, when linked against MIT Kerberos, does not properly initialize the Kerberos libraries for setuid use, which allows local users to gain privileges by pointing an environment variable to a modified Kerberos configuration file, and then launching a PAM-based setuid application.
References
cve@mitre.orghttp://secunia.com/advisories/33914Vendor Advisory
cve@mitre.orghttp://secunia.com/advisories/33917Vendor Advisory
cve@mitre.orghttp://secunia.com/advisories/34260
cve@mitre.orghttp://secunia.com/advisories/34449
cve@mitre.orghttp://security.gentoo.org/glsa/glsa-200903-39.xml
cve@mitre.orghttp://securitytracker.com/id?1021711
cve@mitre.orghttp://sunsolve.sun.com/search/document.do?assetkey=1-66-252767-1
cve@mitre.orghttp://support.avaya.com/elmodocs2/security/ASA-2009-070.htm
cve@mitre.orghttp://www.debian.org/security/2009/dsa-1721
cve@mitre.orghttp://www.eyrie.org/~eagle/software/pam-krb5/security/2009-02-11.htmlVendor Advisory
cve@mitre.orghttp://www.securityfocus.com/archive/1/500892/100/0/threaded
cve@mitre.orghttp://www.securityfocus.com/bid/33740
cve@mitre.orghttp://www.ubuntu.com/usn/USN-719-1
cve@mitre.orghttp://www.vupen.com/english/advisories/2009/0410
cve@mitre.orghttp://www.vupen.com/english/advisories/2009/0426
cve@mitre.orghttp://www.vupen.com/english/advisories/2009/0979
cve@mitre.orghttps://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A5669
cve@mitre.orghttps://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A5732
af854a3a-2127-422b-91ae-364da2661108http://secunia.com/advisories/33914Vendor Advisory
af854a3a-2127-422b-91ae-364da2661108http://secunia.com/advisories/33917Vendor Advisory
af854a3a-2127-422b-91ae-364da2661108http://secunia.com/advisories/34260
af854a3a-2127-422b-91ae-364da2661108http://secunia.com/advisories/34449
af854a3a-2127-422b-91ae-364da2661108http://security.gentoo.org/glsa/glsa-200903-39.xml
af854a3a-2127-422b-91ae-364da2661108http://securitytracker.com/id?1021711
af854a3a-2127-422b-91ae-364da2661108http://sunsolve.sun.com/search/document.do?assetkey=1-66-252767-1
af854a3a-2127-422b-91ae-364da2661108http://support.avaya.com/elmodocs2/security/ASA-2009-070.htm
af854a3a-2127-422b-91ae-364da2661108http://www.debian.org/security/2009/dsa-1721
af854a3a-2127-422b-91ae-364da2661108http://www.eyrie.org/~eagle/software/pam-krb5/security/2009-02-11.htmlVendor Advisory
af854a3a-2127-422b-91ae-364da2661108http://www.securityfocus.com/archive/1/500892/100/0/threaded
af854a3a-2127-422b-91ae-364da2661108http://www.securityfocus.com/bid/33740
af854a3a-2127-422b-91ae-364da2661108http://www.ubuntu.com/usn/USN-719-1
af854a3a-2127-422b-91ae-364da2661108http://www.vupen.com/english/advisories/2009/0410
af854a3a-2127-422b-91ae-364da2661108http://www.vupen.com/english/advisories/2009/0426
af854a3a-2127-422b-91ae-364da2661108http://www.vupen.com/english/advisories/2009/0979
af854a3a-2127-422b-91ae-364da2661108https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A5669
af854a3a-2127-422b-91ae-364da2661108https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A5732
Impacted products
Vendor Product Version
Show details on NVD website

To clipboard 

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-07T04:31:25.684Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "name": "34260",
            "tags": [
              "third-party-advisory",
              "x_refsource_SECUNIA",
              "x_transferred"
            ],
            "url": "http://secunia.com/advisories/34260"
          },
          {
            "name": "252767",
            "tags": [
              "vendor-advisory",
              "x_refsource_SUNALERT",
              "x_transferred"
            ],
            "url": "http://sunsolve.sun.com/search/document.do?assetkey=1-66-252767-1"
          },
          {
            "name": "oval:org.mitre.oval:def:5732",
            "tags": [
              "vdb-entry",
              "signature",
              "x_refsource_OVAL",
              "x_transferred"
            ],
            "url": "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A5732"
          },
          {
            "name": "33914",
            "tags": [
              "third-party-advisory",
              "x_refsource_SECUNIA",
              "x_transferred"
            ],
            "url": "http://secunia.com/advisories/33914"
          },
          {
            "name": "USN-719-1",
            "tags": [
              "vendor-advisory",
              "x_refsource_UBUNTU",
              "x_transferred"
            ],
            "url": "http://www.ubuntu.com/usn/USN-719-1"
          },
          {
            "name": "ADV-2009-0426",
            "tags": [
              "vdb-entry",
              "x_refsource_VUPEN",
              "x_transferred"
            ],
            "url": "http://www.vupen.com/english/advisories/2009/0426"
          },
          {
            "name": "1021711",
            "tags": [
              "vdb-entry",
              "x_refsource_SECTRACK",
              "x_transferred"
            ],
            "url": "http://securitytracker.com/id?1021711"
          },
          {
            "name": "ADV-2009-0410",
            "tags": [
              "vdb-entry",
              "x_refsource_VUPEN",
              "x_transferred"
            ],
            "url": "http://www.vupen.com/english/advisories/2009/0410"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "http://support.avaya.com/elmodocs2/security/ASA-2009-070.htm"
          },
          {
            "name": "34449",
            "tags": [
              "third-party-advisory",
              "x_refsource_SECUNIA",
              "x_transferred"
            ],
            "url": "http://secunia.com/advisories/34449"
          },
          {
            "name": "33917",
            "tags": [
              "third-party-advisory",
              "x_refsource_SECUNIA",
              "x_transferred"
            ],
            "url": "http://secunia.com/advisories/33917"
          },
          {
            "name": "DSA-1721",
            "tags": [
              "vendor-advisory",
              "x_refsource_DEBIAN",
              "x_transferred"
            ],
            "url": "http://www.debian.org/security/2009/dsa-1721"
          },
          {
            "name": "20090211 pam-krb5 security advisory (3.12 and earlier)",
            "tags": [
              "mailing-list",
              "x_refsource_BUGTRAQ",
              "x_transferred"
            ],
            "url": "http://www.securityfocus.com/archive/1/500892/100/0/threaded"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "http://www.eyrie.org/~eagle/software/pam-krb5/security/2009-02-11.html"
          },
          {
            "name": "GLSA-200903-39",
            "tags": [
              "vendor-advisory",
              "x_refsource_GENTOO",
              "x_transferred"
            ],
            "url": "http://security.gentoo.org/glsa/glsa-200903-39.xml"
          },
          {
            "name": "oval:org.mitre.oval:def:5669",
            "tags": [
              "vdb-entry",
              "signature",
              "x_refsource_OVAL",
              "x_transferred"
            ],
            "url": "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A5669"
          },
          {
            "name": "33740",
            "tags": [
              "vdb-entry",
              "x_refsource_BID",
              "x_transferred"
            ],
            "url": "http://www.securityfocus.com/bid/33740"
          },
          {
            "name": "ADV-2009-0979",
            "tags": [
              "vdb-entry",
              "x_refsource_VUPEN",
              "x_transferred"
            ],
            "url": "http://www.vupen.com/english/advisories/2009/0979"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "datePublic": "2009-02-11T00:00:00",
      "descriptions": [
        {
          "lang": "en",
          "value": "Russ Allbery pam-krb5 before 3.13, when linked against MIT Kerberos, does not properly initialize the Kerberos libraries for setuid use, which allows local users to gain privileges by pointing an environment variable to a modified Kerberos configuration file, and then launching a PAM-based setuid application."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "n/a",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2018-10-11T19:57:01",
        "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
        "shortName": "mitre"
      },
      "references": [
        {
          "name": "34260",
          "tags": [
            "third-party-advisory",
            "x_refsource_SECUNIA"
          ],
          "url": "http://secunia.com/advisories/34260"
        },
        {
          "name": "252767",
          "tags": [
            "vendor-advisory",
            "x_refsource_SUNALERT"
          ],
          "url": "http://sunsolve.sun.com/search/document.do?assetkey=1-66-252767-1"
        },
        {
          "name": "oval:org.mitre.oval:def:5732",
          "tags": [
            "vdb-entry",
            "signature",
            "x_refsource_OVAL"
          ],
          "url": "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A5732"
        },
        {
          "name": "33914",
          "tags": [
            "third-party-advisory",
            "x_refsource_SECUNIA"
          ],
          "url": "http://secunia.com/advisories/33914"
        },
        {
          "name": "USN-719-1",
          "tags": [
            "vendor-advisory",
            "x_refsource_UBUNTU"
          ],
          "url": "http://www.ubuntu.com/usn/USN-719-1"
        },
        {
          "name": "ADV-2009-0426",
          "tags": [
            "vdb-entry",
            "x_refsource_VUPEN"
          ],
          "url": "http://www.vupen.com/english/advisories/2009/0426"
        },
        {
          "name": "1021711",
          "tags": [
            "vdb-entry",
            "x_refsource_SECTRACK"
          ],
          "url": "http://securitytracker.com/id?1021711"
        },
        {
          "name": "ADV-2009-0410",
          "tags": [
            "vdb-entry",
            "x_refsource_VUPEN"
          ],
          "url": "http://www.vupen.com/english/advisories/2009/0410"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "http://support.avaya.com/elmodocs2/security/ASA-2009-070.htm"
        },
        {
          "name": "34449",
          "tags": [
            "third-party-advisory",
            "x_refsource_SECUNIA"
          ],
          "url": "http://secunia.com/advisories/34449"
        },
        {
          "name": "33917",
          "tags": [
            "third-party-advisory",
            "x_refsource_SECUNIA"
          ],
          "url": "http://secunia.com/advisories/33917"
        },
        {
          "name": "DSA-1721",
          "tags": [
            "vendor-advisory",
            "x_refsource_DEBIAN"
          ],
          "url": "http://www.debian.org/security/2009/dsa-1721"
        },
        {
          "name": "20090211 pam-krb5 security advisory (3.12 and earlier)",
          "tags": [
            "mailing-list",
            "x_refsource_BUGTRAQ"
          ],
          "url": "http://www.securityfocus.com/archive/1/500892/100/0/threaded"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "http://www.eyrie.org/~eagle/software/pam-krb5/security/2009-02-11.html"
        },
        {
          "name": "GLSA-200903-39",
          "tags": [
            "vendor-advisory",
            "x_refsource_GENTOO"
          ],
          "url": "http://security.gentoo.org/glsa/glsa-200903-39.xml"
        },
        {
          "name": "oval:org.mitre.oval:def:5669",
          "tags": [
            "vdb-entry",
            "signature",
            "x_refsource_OVAL"
          ],
          "url": "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A5669"
        },
        {
          "name": "33740",
          "tags": [
            "vdb-entry",
            "x_refsource_BID"
          ],
          "url": "http://www.securityfocus.com/bid/33740"
        },
        {
          "name": "ADV-2009-0979",
          "tags": [
            "vdb-entry",
            "x_refsource_VUPEN"
          ],
          "url": "http://www.vupen.com/english/advisories/2009/0979"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "cve@mitre.org",
          "ID": "CVE-2009-0360",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "n/a",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "n/a"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "n/a"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "Russ Allbery pam-krb5 before 3.13, when linked against MIT Kerberos, does not properly initialize the Kerberos libraries for setuid use, which allows local users to gain privileges by pointing an environment variable to a modified Kerberos configuration file, and then launching a PAM-based setuid application."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "n/a"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "34260",
              "refsource": "SECUNIA",
              "url": "http://secunia.com/advisories/34260"
            },
            {
              "name": "252767",
              "refsource": "SUNALERT",
              "url": "http://sunsolve.sun.com/search/document.do?assetkey=1-66-252767-1"
            },
            {
              "name": "oval:org.mitre.oval:def:5732",
              "refsource": "OVAL",
              "url": "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A5732"
            },
            {
              "name": "33914",
              "refsource": "SECUNIA",
              "url": "http://secunia.com/advisories/33914"
            },
            {
              "name": "USN-719-1",
              "refsource": "UBUNTU",
              "url": "http://www.ubuntu.com/usn/USN-719-1"
            },
            {
              "name": "ADV-2009-0426",
              "refsource": "VUPEN",
              "url": "http://www.vupen.com/english/advisories/2009/0426"
            },
            {
              "name": "1021711",
              "refsource": "SECTRACK",
              "url": "http://securitytracker.com/id?1021711"
            },
            {
              "name": "ADV-2009-0410",
              "refsource": "VUPEN",
              "url": "http://www.vupen.com/english/advisories/2009/0410"
            },
            {
              "name": "http://support.avaya.com/elmodocs2/security/ASA-2009-070.htm",
              "refsource": "CONFIRM",
              "url": "http://support.avaya.com/elmodocs2/security/ASA-2009-070.htm"
            },
            {
              "name": "34449",
              "refsource": "SECUNIA",
              "url": "http://secunia.com/advisories/34449"
            },
            {
              "name": "33917",
              "refsource": "SECUNIA",
              "url": "http://secunia.com/advisories/33917"
            },
            {
              "name": "DSA-1721",
              "refsource": "DEBIAN",
              "url": "http://www.debian.org/security/2009/dsa-1721"
            },
            {
              "name": "20090211 pam-krb5 security advisory (3.12 and earlier)",
              "refsource": "BUGTRAQ",
              "url": "http://www.securityfocus.com/archive/1/500892/100/0/threaded"
            },
            {
              "name": "http://www.eyrie.org/~eagle/software/pam-krb5/security/2009-02-11.html",
              "refsource": "MISC",
              "url": "http://www.eyrie.org/~eagle/software/pam-krb5/security/2009-02-11.html"
            },
            {
              "name": "GLSA-200903-39",
              "refsource": "GENTOO",
              "url": "http://security.gentoo.org/glsa/glsa-200903-39.xml"
            },
            {
              "name": "oval:org.mitre.oval:def:5669",
              "refsource": "OVAL",
              "url": "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A5669"
            },
            {
              "name": "33740",
              "refsource": "BID",
              "url": "http://www.securityfocus.com/bid/33740"
            },
            {
              "name": "ADV-2009-0979",
              "refsource": "VUPEN",
              "url": "http://www.vupen.com/english/advisories/2009/0979"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
    "assignerShortName": "mitre",
    "cveId": "CVE-2009-0360",
    "datePublished": "2009-02-13T17:00:00",
    "dateReserved": "2009-01-29T00:00:00",
    "dateUpdated": "2024-08-07T04:31:25.684Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1",
  "meta": {
    "nvd": "{\"cve\":{\"id\":\"CVE-2009-0360\",\"sourceIdentifier\":\"cve@mitre.org\",\"published\":\"2009-02-13T17:30:00.640\",\"lastModified\":\"2024-11-21T00:59:43.377\",\"vulnStatus\":\"Modified\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"Russ Allbery pam-krb5 before 3.13, when linked against MIT Kerberos, does not properly initialize the Kerberos libraries for setuid use, which allows local users to gain privileges by pointing an environment variable to a modified Kerberos configuration file, and then launching a PAM-based setuid application.\"},{\"lang\":\"es\",\"value\":\"Russ Allbery pam-krb5 versiones anteriores a v3.13, cuando es enlazado a trav\u00e9s de MIT Kerberos, no inicializa correctamente las librer\u00edas Kerberos al usarlas en la fijaci\u00f3n de propietario, permitiendo a usuarios locales obtener privilegios al apuntar una variable de entorno a un fichero de configuraci\u00f3n de Kerberos modificado, y despu\u00e9s llamando a una aplicaci\u00f3n de fijaci\u00f3n de propietario basada en PAM.\"}],\"metrics\":{\"cvssMetricV2\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"2.0\",\"vectorString\":\"AV:L/AC:H/Au:N/C:C/I:C/A:C\",\"baseScore\":6.2,\"accessVector\":\"LOCAL\",\"accessComplexity\":\"HIGH\",\"authentication\":\"NONE\",\"confidentialityImpact\":\"COMPLETE\",\"integrityImpact\":\"COMPLETE\",\"availabilityImpact\":\"COMPLETE\"},\"baseSeverity\":\"MEDIUM\",\"exploitabilityScore\":1.9,\"impactScore\":10.0,\"acInsufInfo\":false,\"obtainAllPrivilege\":true,\"obtainUserPrivilege\":false,\"obtainOtherPrivilege\":false,\"userInteractionRequired\":false}]},\"weaknesses\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-287\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:eyrie:pam-krb5:*:*:*:*:*:*:*:*\",\"versionEndIncluding\":\"3.12\",\"matchCriteriaId\":\"989241C8-BC2F-4DE2-BF9E-9CC64198AF5A\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:eyrie:pam-krb5:2.0:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"D4E491A2-9478-4462-8BCD-6DD79954C418\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:eyrie:pam-krb5:2.1:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"4837527C-9618-412F-A8CB-87122CF35B71\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:eyrie:pam-krb5:2.2:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"F20698B7-B13B-488C-A49F-90A4490DA0F5\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:eyrie:pam-krb5:2.3:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"81821DD4-343A-4CDE-A7A6-CA606662971C\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:eyrie:pam-krb5:2.4:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"D7A629B4-55FA-418E-97FC-935B022A4F92\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:eyrie:pam-krb5:2.5:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"8B5451CD-CDCC-4D9D-A076-45E7B14EEF76\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:eyrie:pam-krb5:2.6:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"F7761042-9FFB-4235-9A34-22B91CE2CA73\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:eyrie:pam-krb5:3.0:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"633EE1E7-1B5D-4D10-BA4B-D13A15BA68B2\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:eyrie:pam-krb5:3.1:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"4B6844EE-3552-429A-A3D8-9A6B6C3B2785\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:eyrie:pam-krb5:3.2:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"D9619E40-83AA-46D6-AECF-CC7FF6B1ED1B\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:eyrie:pam-krb5:3.3:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"1FF1D6C7-15E6-4DAA-92C1-C216905866B4\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:eyrie:pam-krb5:3.4:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"BB0342E5-B622-4A5E-A57F-6EAF85E268C1\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:eyrie:pam-krb5:3.5:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"B2684C7D-B266-4460-9DAD-945B4DECF57C\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:eyrie:pam-krb5:3.6:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"FDC110CB-253F-44E6-8515-FC9025EBF57F\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:eyrie:pam-krb5:3.7:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"D78AEED8-34AB-41B7-926F-6F7995253E5A\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:eyrie:pam-krb5:3.8:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"FB53833E-EB9E-4ED8-8BC5-B681BE0B2897\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:eyrie:pam-krb5:3.9:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"0FE72618-6BE5-45F3-A782-991A73C09389\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:eyrie:pam-krb5:3.10:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"315E2FB7-EEE5-48AA-B058-F53AEA210807\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:eyrie:pam-krb5:3.11:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"A4421B50-CC46-4EA6-AACF-DBE0EE76A389\"}]}]}],\"references\":[{\"url\":\"http://secunia.com/advisories/33914\",\"source\":\"cve@mitre.org\",\"tags\":[\"Vendor Advisory\"]},{\"url\":\"http://secunia.com/advisories/33917\",\"source\":\"cve@mitre.org\",\"tags\":[\"Vendor Advisory\"]},{\"url\":\"http://secunia.com/advisories/34260\",\"source\":\"cve@mitre.org\"},{\"url\":\"http://secunia.com/advisories/34449\",\"source\":\"cve@mitre.org\"},{\"url\":\"http://security.gentoo.org/glsa/glsa-200903-39.xml\",\"source\":\"cve@mitre.org\"},{\"url\":\"http://securitytracker.com/id?1021711\",\"source\":\"cve@mitre.org\"},{\"url\":\"http://sunsolve.sun.com/search/document.do?assetkey=1-66-252767-1\",\"source\":\"cve@mitre.org\"},{\"url\":\"http://support.avaya.com/elmodocs2/security/ASA-2009-070.htm\",\"source\":\"cve@mitre.org\"},{\"url\":\"http://www.debian.org/security/2009/dsa-1721\",\"source\":\"cve@mitre.org\"},{\"url\":\"http://www.eyrie.org/~eagle/software/pam-krb5/security/2009-02-11.html\",\"source\":\"cve@mitre.org\",\"tags\":[\"Vendor Advisory\"]},{\"url\":\"http://www.securityfocus.com/archive/1/500892/100/0/threaded\",\"source\":\"cve@mitre.org\"},{\"url\":\"http://www.securityfocus.com/bid/33740\",\"source\":\"cve@mitre.org\"},{\"url\":\"http://www.ubuntu.com/usn/USN-719-1\",\"source\":\"cve@mitre.org\"},{\"url\":\"http://www.vupen.com/english/advisories/2009/0410\",\"source\":\"cve@mitre.org\"},{\"url\":\"http://www.vupen.com/english/advisories/2009/0426\",\"source\":\"cve@mitre.org\"},{\"url\":\"http://www.vupen.com/english/advisories/2009/0979\",\"source\":\"cve@mitre.org\"},{\"url\":\"https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A5669\",\"source\":\"cve@mitre.org\"},{\"url\":\"https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A5732\",\"source\":\"cve@mitre.org\"},{\"url\":\"http://secunia.com/advisories/33914\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Vendor Advisory\"]},{\"url\":\"http://secunia.com/advisories/33917\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Vendor Advisory\"]},{\"url\":\"http://secunia.com/advisories/34260\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"http://secunia.com/advisories/34449\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"http://security.gentoo.org/glsa/glsa-200903-39.xml\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"http://securitytracker.com/id?1021711\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"http://sunsolve.sun.com/search/document.do?assetkey=1-66-252767-1\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"http://support.avaya.com/elmodocs2/security/ASA-2009-070.htm\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"http://www.debian.org/security/2009/dsa-1721\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"http://www.eyrie.org/~eagle/software/pam-krb5/security/2009-02-11.html\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Vendor Advisory\"]},{\"url\":\"http://www.securityfocus.com/archive/1/500892/100/0/threaded\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"http://www.securityfocus.com/bid/33740\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"http://www.ubuntu.com/usn/USN-719-1\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"http://www.vupen.com/english/advisories/2009/0410\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"http://www.vupen.com/english/advisories/2009/0426\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"http://www.vupen.com/english/advisories/2009/0979\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A5669\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A5732\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"}],\"evaluatorComment\":\"Per vendor advisory:\\r\\n http://www.eyrie.org/~eagle/software/pam-krb5/security/2009-02-11.html\\r\\n\\r\\n\\\"This advisory is only for my pam-krb5 module, as distributed from my web site and packaged by Debian, Ubuntu, and Gentoo.\\\"\",\"vendorComments\":[{\"organization\":\"Red Hat\",\"comment\":\"Not vulnerable. This issue did not affect the versions of the pam_krb5 package, as shipped with Red Hat Enterprise Linux 2.1, 3, 4, or 5.\",\"lastModified\":\"2009-02-13T00:00:00\"}]}}"
  }
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
  • Confirmed: The vulnerability is confirmed from an analyst perspective.
  • Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
  • Patched: This vulnerability was successfully patched by the user reporting the sighting.
  • Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
  • Not confirmed: The user expresses doubt about the veracity of the vulnerability.
  • Not patched: This vulnerability was not successfully patched by the user reporting the sighting.