CVE-2009-0360 (GCVE-0-2009-0360)
Vulnerability from cvelistv5
Published
2009-02-13 17:00
Modified
2024-08-07 04:31
Severity ?
CWE
  • n/a
Summary
Russ Allbery pam-krb5 before 3.13, when linked against MIT Kerberos, does not properly initialize the Kerberos libraries for setuid use, which allows local users to gain privileges by pointing an environment variable to a modified Kerberos configuration file, and then launching a PAM-based setuid application.
References
cve@mitre.org http://secunia.com/advisories/33914 Vendor Advisory
cve@mitre.org http://secunia.com/advisories/33917 Vendor Advisory
cve@mitre.org http://secunia.com/advisories/34260
cve@mitre.org http://secunia.com/advisories/34449
cve@mitre.org http://security.gentoo.org/glsa/glsa-200903-39.xml
cve@mitre.org http://securitytracker.com/id?1021711
cve@mitre.org http://sunsolve.sun.com/search/document.do?assetkey=1-66-252767-1
cve@mitre.org http://support.avaya.com/elmodocs2/security/ASA-2009-070.htm
cve@mitre.org http://www.debian.org/security/2009/dsa-1721
cve@mitre.org http://www.eyrie.org/~eagle/software/pam-krb5/security/2009-02-11.html Vendor Advisory
cve@mitre.org http://www.securityfocus.com/archive/1/500892/100/0/threaded
cve@mitre.org http://www.securityfocus.com/bid/33740
cve@mitre.org http://www.ubuntu.com/usn/USN-719-1
cve@mitre.org http://www.vupen.com/english/advisories/2009/0410
cve@mitre.org http://www.vupen.com/english/advisories/2009/0426
cve@mitre.org http://www.vupen.com/english/advisories/2009/0979
cve@mitre.org https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A5669
cve@mitre.org https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A5732
af854a3a-2127-422b-91ae-364da2661108 http://secunia.com/advisories/33914 Vendor Advisory
af854a3a-2127-422b-91ae-364da2661108 http://secunia.com/advisories/33917 Vendor Advisory
af854a3a-2127-422b-91ae-364da2661108 http://secunia.com/advisories/34260
af854a3a-2127-422b-91ae-364da2661108 http://secunia.com/advisories/34449
af854a3a-2127-422b-91ae-364da2661108 http://security.gentoo.org/glsa/glsa-200903-39.xml
af854a3a-2127-422b-91ae-364da2661108 http://securitytracker.com/id?1021711
af854a3a-2127-422b-91ae-364da2661108 http://sunsolve.sun.com/search/document.do?assetkey=1-66-252767-1
af854a3a-2127-422b-91ae-364da2661108 http://support.avaya.com/elmodocs2/security/ASA-2009-070.htm
af854a3a-2127-422b-91ae-364da2661108 http://www.debian.org/security/2009/dsa-1721
af854a3a-2127-422b-91ae-364da2661108 http://www.eyrie.org/~eagle/software/pam-krb5/security/2009-02-11.html Vendor Advisory
af854a3a-2127-422b-91ae-364da2661108 http://www.securityfocus.com/archive/1/500892/100/0/threaded
af854a3a-2127-422b-91ae-364da2661108 http://www.securityfocus.com/bid/33740
af854a3a-2127-422b-91ae-364da2661108 http://www.ubuntu.com/usn/USN-719-1
af854a3a-2127-422b-91ae-364da2661108 http://www.vupen.com/english/advisories/2009/0410
af854a3a-2127-422b-91ae-364da2661108 http://www.vupen.com/english/advisories/2009/0426
af854a3a-2127-422b-91ae-364da2661108 http://www.vupen.com/english/advisories/2009/0979
af854a3a-2127-422b-91ae-364da2661108 https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A5669
af854a3a-2127-422b-91ae-364da2661108 https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A5732
Impacted products
Vendor Product Version
n/a n/a Version: n/a
Show details on NVD website

To clipboard 

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-07T04:31:25.684Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "name": "34260",
            "tags": [
              "third-party-advisory",
              "x_refsource_SECUNIA",
              "x_transferred"
            ],
            "url": "http://secunia.com/advisories/34260"
          },
          {
            "name": "252767",
            "tags": [
              "vendor-advisory",
              "x_refsource_SUNALERT",
              "x_transferred"
            ],
            "url": "http://sunsolve.sun.com/search/document.do?assetkey=1-66-252767-1"
          },
          {
            "name": "oval:org.mitre.oval:def:5732",
            "tags": [
              "vdb-entry",
              "signature",
              "x_refsource_OVAL",
              "x_transferred"
            ],
            "url": "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A5732"
          },
          {
            "name": "33914",
            "tags": [
              "third-party-advisory",
              "x_refsource_SECUNIA",
              "x_transferred"
            ],
            "url": "http://secunia.com/advisories/33914"
          },
          {
            "name": "USN-719-1",
            "tags": [
              "vendor-advisory",
              "x_refsource_UBUNTU",
              "x_transferred"
            ],
            "url": "http://www.ubuntu.com/usn/USN-719-1"
          },
          {
            "name": "ADV-2009-0426",
            "tags": [
              "vdb-entry",
              "x_refsource_VUPEN",
              "x_transferred"
            ],
            "url": "http://www.vupen.com/english/advisories/2009/0426"
          },
          {
            "name": "1021711",
            "tags": [
              "vdb-entry",
              "x_refsource_SECTRACK",
              "x_transferred"
            ],
            "url": "http://securitytracker.com/id?1021711"
          },
          {
            "name": "ADV-2009-0410",
            "tags": [
              "vdb-entry",
              "x_refsource_VUPEN",
              "x_transferred"
            ],
            "url": "http://www.vupen.com/english/advisories/2009/0410"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "http://support.avaya.com/elmodocs2/security/ASA-2009-070.htm"
          },
          {
            "name": "34449",
            "tags": [
              "third-party-advisory",
              "x_refsource_SECUNIA",
              "x_transferred"
            ],
            "url": "http://secunia.com/advisories/34449"
          },
          {
            "name": "33917",
            "tags": [
              "third-party-advisory",
              "x_refsource_SECUNIA",
              "x_transferred"
            ],
            "url": "http://secunia.com/advisories/33917"
          },
          {
            "name": "DSA-1721",
            "tags": [
              "vendor-advisory",
              "x_refsource_DEBIAN",
              "x_transferred"
            ],
            "url": "http://www.debian.org/security/2009/dsa-1721"
          },
          {
            "name": "20090211 pam-krb5 security advisory (3.12 and earlier)",
            "tags": [
              "mailing-list",
              "x_refsource_BUGTRAQ",
              "x_transferred"
            ],
            "url": "http://www.securityfocus.com/archive/1/500892/100/0/threaded"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "http://www.eyrie.org/~eagle/software/pam-krb5/security/2009-02-11.html"
          },
          {
            "name": "GLSA-200903-39",
            "tags": [
              "vendor-advisory",
              "x_refsource_GENTOO",
              "x_transferred"
            ],
            "url": "http://security.gentoo.org/glsa/glsa-200903-39.xml"
          },
          {
            "name": "oval:org.mitre.oval:def:5669",
            "tags": [
              "vdb-entry",
              "signature",
              "x_refsource_OVAL",
              "x_transferred"
            ],
            "url": "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A5669"
          },
          {
            "name": "33740",
            "tags": [
              "vdb-entry",
              "x_refsource_BID",
              "x_transferred"
            ],
            "url": "http://www.securityfocus.com/bid/33740"
          },
          {
            "name": "ADV-2009-0979",
            "tags": [
              "vdb-entry",
              "x_refsource_VUPEN",
              "x_transferred"
            ],
            "url": "http://www.vupen.com/english/advisories/2009/0979"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "datePublic": "2009-02-11T00:00:00",
      "descriptions": [
        {
          "lang": "en",
          "value": "Russ Allbery pam-krb5 before 3.13, when linked against MIT Kerberos, does not properly initialize the Kerberos libraries for setuid use, which allows local users to gain privileges by pointing an environment variable to a modified Kerberos configuration file, and then launching a PAM-based setuid application."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "n/a",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2018-10-11T19:57:01",
        "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
        "shortName": "mitre"
      },
      "references": [
        {
          "name": "34260",
          "tags": [
            "third-party-advisory",
            "x_refsource_SECUNIA"
          ],
          "url": "http://secunia.com/advisories/34260"
        },
        {
          "name": "252767",
          "tags": [
            "vendor-advisory",
            "x_refsource_SUNALERT"
          ],
          "url": "http://sunsolve.sun.com/search/document.do?assetkey=1-66-252767-1"
        },
        {
          "name": "oval:org.mitre.oval:def:5732",
          "tags": [
            "vdb-entry",
            "signature",
            "x_refsource_OVAL"
          ],
          "url": "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A5732"
        },
        {
          "name": "33914",
          "tags": [
            "third-party-advisory",
            "x_refsource_SECUNIA"
          ],
          "url": "http://secunia.com/advisories/33914"
        },
        {
          "name": "USN-719-1",
          "tags": [
            "vendor-advisory",
            "x_refsource_UBUNTU"
          ],
          "url": "http://www.ubuntu.com/usn/USN-719-1"
        },
        {
          "name": "ADV-2009-0426",
          "tags": [
            "vdb-entry",
            "x_refsource_VUPEN"
          ],
          "url": "http://www.vupen.com/english/advisories/2009/0426"
        },
        {
          "name": "1021711",
          "tags": [
            "vdb-entry",
            "x_refsource_SECTRACK"
          ],
          "url": "http://securitytracker.com/id?1021711"
        },
        {
          "name": "ADV-2009-0410",
          "tags": [
            "vdb-entry",
            "x_refsource_VUPEN"
          ],
          "url": "http://www.vupen.com/english/advisories/2009/0410"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "http://support.avaya.com/elmodocs2/security/ASA-2009-070.htm"
        },
        {
          "name": "34449",
          "tags": [
            "third-party-advisory",
            "x_refsource_SECUNIA"
          ],
          "url": "http://secunia.com/advisories/34449"
        },
        {
          "name": "33917",
          "tags": [
            "third-party-advisory",
            "x_refsource_SECUNIA"
          ],
          "url": "http://secunia.com/advisories/33917"
        },
        {
          "name": "DSA-1721",
          "tags": [
            "vendor-advisory",
            "x_refsource_DEBIAN"
          ],
          "url": "http://www.debian.org/security/2009/dsa-1721"
        },
        {
          "name": "20090211 pam-krb5 security advisory (3.12 and earlier)",
          "tags": [
            "mailing-list",
            "x_refsource_BUGTRAQ"
          ],
          "url": "http://www.securityfocus.com/archive/1/500892/100/0/threaded"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "http://www.eyrie.org/~eagle/software/pam-krb5/security/2009-02-11.html"
        },
        {
          "name": "GLSA-200903-39",
          "tags": [
            "vendor-advisory",
            "x_refsource_GENTOO"
          ],
          "url": "http://security.gentoo.org/glsa/glsa-200903-39.xml"
        },
        {
          "name": "oval:org.mitre.oval:def:5669",
          "tags": [
            "vdb-entry",
            "signature",
            "x_refsource_OVAL"
          ],
          "url": "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A5669"
        },
        {
          "name": "33740",
          "tags": [
            "vdb-entry",
            "x_refsource_BID"
          ],
          "url": "http://www.securityfocus.com/bid/33740"
        },
        {
          "name": "ADV-2009-0979",
          "tags": [
            "vdb-entry",
            "x_refsource_VUPEN"
          ],
          "url": "http://www.vupen.com/english/advisories/2009/0979"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "cve@mitre.org",
          "ID": "CVE-2009-0360",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "n/a",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "n/a"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "n/a"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "Russ Allbery pam-krb5 before 3.13, when linked against MIT Kerberos, does not properly initialize the Kerberos libraries for setuid use, which allows local users to gain privileges by pointing an environment variable to a modified Kerberos configuration file, and then launching a PAM-based setuid application."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "n/a"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "34260",
              "refsource": "SECUNIA",
              "url": "http://secunia.com/advisories/34260"
            },
            {
              "name": "252767",
              "refsource": "SUNALERT",
              "url": "http://sunsolve.sun.com/search/document.do?assetkey=1-66-252767-1"
            },
            {
              "name": "oval:org.mitre.oval:def:5732",
              "refsource": "OVAL",
              "url": "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A5732"
            },
            {
              "name": "33914",
              "refsource": "SECUNIA",
              "url": "http://secunia.com/advisories/33914"
            },
            {
              "name": "USN-719-1",
              "refsource": "UBUNTU",
              "url": "http://www.ubuntu.com/usn/USN-719-1"
            },
            {
              "name": "ADV-2009-0426",
              "refsource": "VUPEN",
              "url": "http://www.vupen.com/english/advisories/2009/0426"
            },
            {
              "name": "1021711",
              "refsource": "SECTRACK",
              "url": "http://securitytracker.com/id?1021711"
            },
            {
              "name": "ADV-2009-0410",
              "refsource": "VUPEN",
              "url": "http://www.vupen.com/english/advisories/2009/0410"
            },
            {
              "name": "http://support.avaya.com/elmodocs2/security/ASA-2009-070.htm",
              "refsource": "CONFIRM",
              "url": "http://support.avaya.com/elmodocs2/security/ASA-2009-070.htm"
            },
            {
              "name": "34449",
              "refsource": "SECUNIA",
              "url": "http://secunia.com/advisories/34449"
            },
            {
              "name": "33917",
              "refsource": "SECUNIA",
              "url": "http://secunia.com/advisories/33917"
            },
            {
              "name": "DSA-1721",
              "refsource": "DEBIAN",
              "url": "http://www.debian.org/security/2009/dsa-1721"
            },
            {
              "name": "20090211 pam-krb5 security advisory (3.12 and earlier)",
              "refsource": "BUGTRAQ",
              "url": "http://www.securityfocus.com/archive/1/500892/100/0/threaded"
            },
            {
              "name": "http://www.eyrie.org/~eagle/software/pam-krb5/security/2009-02-11.html",
              "refsource": "MISC",
              "url": "http://www.eyrie.org/~eagle/software/pam-krb5/security/2009-02-11.html"
            },
            {
              "name": "GLSA-200903-39",
              "refsource": "GENTOO",
              "url": "http://security.gentoo.org/glsa/glsa-200903-39.xml"
            },
            {
              "name": "oval:org.mitre.oval:def:5669",
              "refsource": "OVAL",
              "url": "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A5669"
            },
            {
              "name": "33740",
              "refsource": "BID",
              "url": "http://www.securityfocus.com/bid/33740"
            },
            {
              "name": "ADV-2009-0979",
              "refsource": "VUPEN",
              "url": "http://www.vupen.com/english/advisories/2009/0979"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
    "assignerShortName": "mitre",
    "cveId": "CVE-2009-0360",
    "datePublished": "2009-02-13T17:00:00",
    "dateReserved": "2009-01-29T00:00:00",
    "dateUpdated": "2024-08-07T04:31:25.684Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1",
  "vulnerability-lookup:meta": {
    "nvd": "{\"cve\":{\"id\":\"CVE-2009-0360\",\"sourceIdentifier\":\"cve@mitre.org\",\"published\":\"2009-02-13T17:30:00.640\",\"lastModified\":\"2025-04-09T00:30:58.490\",\"vulnStatus\":\"Deferred\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"Russ Allbery pam-krb5 before 3.13, when linked against MIT Kerberos, does not properly initialize the Kerberos libraries for setuid use, which allows local users to gain privileges by pointing an environment variable to a modified Kerberos configuration file, and then launching a PAM-based setuid application.\"},{\"lang\":\"es\",\"value\":\"Russ Allbery pam-krb5 versiones anteriores a v3.13, cuando es enlazado a trav\u00e9s de MIT Kerberos, no inicializa correctamente las librer\u00edas Kerberos al usarlas en la fijaci\u00f3n de propietario, permitiendo a usuarios locales obtener privilegios al apuntar una variable de entorno a un fichero de configuraci\u00f3n de Kerberos modificado, y despu\u00e9s llamando a una aplicaci\u00f3n de fijaci\u00f3n de propietario basada en PAM.\"}],\"metrics\":{\"cvssMetricV2\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"2.0\",\"vectorString\":\"AV:L/AC:H/Au:N/C:C/I:C/A:C\",\"baseScore\":6.2,\"accessVector\":\"LOCAL\",\"accessComplexity\":\"HIGH\",\"authentication\":\"NONE\",\"confidentialityImpact\":\"COMPLETE\",\"integrityImpact\":\"COMPLETE\",\"availabilityImpact\":\"COMPLETE\"},\"baseSeverity\":\"MEDIUM\",\"exploitabilityScore\":1.9,\"impactScore\":10.0,\"acInsufInfo\":false,\"obtainAllPrivilege\":true,\"obtainUserPrivilege\":false,\"obtainOtherPrivilege\":false,\"userInteractionRequired\":false}]},\"weaknesses\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-287\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:eyrie:pam-krb5:*:*:*:*:*:*:*:*\",\"versionEndIncluding\":\"3.12\",\"matchCriteriaId\":\"989241C8-BC2F-4DE2-BF9E-9CC64198AF5A\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:eyrie:pam-krb5:2.0:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"D4E491A2-9478-4462-8BCD-6DD79954C418\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:eyrie:pam-krb5:2.1:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"4837527C-9618-412F-A8CB-87122CF35B71\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:eyrie:pam-krb5:2.2:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"F20698B7-B13B-488C-A49F-90A4490DA0F5\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:eyrie:pam-krb5:2.3:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"81821DD4-343A-4CDE-A7A6-CA606662971C\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:eyrie:pam-krb5:2.4:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"D7A629B4-55FA-418E-97FC-935B022A4F92\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:eyrie:pam-krb5:2.5:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"8B5451CD-CDCC-4D9D-A076-45E7B14EEF76\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:eyrie:pam-krb5:2.6:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"F7761042-9FFB-4235-9A34-22B91CE2CA73\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:eyrie:pam-krb5:3.0:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"633EE1E7-1B5D-4D10-BA4B-D13A15BA68B2\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:eyrie:pam-krb5:3.1:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"4B6844EE-3552-429A-A3D8-9A6B6C3B2785\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:eyrie:pam-krb5:3.2:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"D9619E40-83AA-46D6-AECF-CC7FF6B1ED1B\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:eyrie:pam-krb5:3.3:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"1FF1D6C7-15E6-4DAA-92C1-C216905866B4\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:eyrie:pam-krb5:3.4:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"BB0342E5-B622-4A5E-A57F-6EAF85E268C1\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:eyrie:pam-krb5:3.5:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"B2684C7D-B266-4460-9DAD-945B4DECF57C\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:eyrie:pam-krb5:3.6:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"FDC110CB-253F-44E6-8515-FC9025EBF57F\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:eyrie:pam-krb5:3.7:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"D78AEED8-34AB-41B7-926F-6F7995253E5A\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:eyrie:pam-krb5:3.8:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"FB53833E-EB9E-4ED8-8BC5-B681BE0B2897\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:eyrie:pam-krb5:3.9:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"0FE72618-6BE5-45F3-A782-991A73C09389\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:eyrie:pam-krb5:3.10:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"315E2FB7-EEE5-48AA-B058-F53AEA210807\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:eyrie:pam-krb5:3.11:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"A4421B50-CC46-4EA6-AACF-DBE0EE76A389\"}]}]}],\"references\":[{\"url\":\"http://secunia.com/advisories/33914\",\"source\":\"cve@mitre.org\",\"tags\":[\"Vendor Advisory\"]},{\"url\":\"http://secunia.com/advisories/33917\",\"source\":\"cve@mitre.org\",\"tags\":[\"Vendor Advisory\"]},{\"url\":\"http://secunia.com/advisories/34260\",\"source\":\"cve@mitre.org\"},{\"url\":\"http://secunia.com/advisories/34449\",\"source\":\"cve@mitre.org\"},{\"url\":\"http://security.gentoo.org/glsa/glsa-200903-39.xml\",\"source\":\"cve@mitre.org\"},{\"url\":\"http://securitytracker.com/id?1021711\",\"source\":\"cve@mitre.org\"},{\"url\":\"http://sunsolve.sun.com/search/document.do?assetkey=1-66-252767-1\",\"source\":\"cve@mitre.org\"},{\"url\":\"http://support.avaya.com/elmodocs2/security/ASA-2009-070.htm\",\"source\":\"cve@mitre.org\"},{\"url\":\"http://www.debian.org/security/2009/dsa-1721\",\"source\":\"cve@mitre.org\"},{\"url\":\"http://www.eyrie.org/~eagle/software/pam-krb5/security/2009-02-11.html\",\"source\":\"cve@mitre.org\",\"tags\":[\"Vendor Advisory\"]},{\"url\":\"http://www.securityfocus.com/archive/1/500892/100/0/threaded\",\"source\":\"cve@mitre.org\"},{\"url\":\"http://www.securityfocus.com/bid/33740\",\"source\":\"cve@mitre.org\"},{\"url\":\"http://www.ubuntu.com/usn/USN-719-1\",\"source\":\"cve@mitre.org\"},{\"url\":\"http://www.vupen.com/english/advisories/2009/0410\",\"source\":\"cve@mitre.org\"},{\"url\":\"http://www.vupen.com/english/advisories/2009/0426\",\"source\":\"cve@mitre.org\"},{\"url\":\"http://www.vupen.com/english/advisories/2009/0979\",\"source\":\"cve@mitre.org\"},{\"url\":\"https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A5669\",\"source\":\"cve@mitre.org\"},{\"url\":\"https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A5732\",\"source\":\"cve@mitre.org\"},{\"url\":\"http://secunia.com/advisories/33914\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Vendor Advisory\"]},{\"url\":\"http://secunia.com/advisories/33917\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Vendor Advisory\"]},{\"url\":\"http://secunia.com/advisories/34260\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"http://secunia.com/advisories/34449\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"http://security.gentoo.org/glsa/glsa-200903-39.xml\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"http://securitytracker.com/id?1021711\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"http://sunsolve.sun.com/search/document.do?assetkey=1-66-252767-1\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"http://support.avaya.com/elmodocs2/security/ASA-2009-070.htm\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"http://www.debian.org/security/2009/dsa-1721\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"http://www.eyrie.org/~eagle/software/pam-krb5/security/2009-02-11.html\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Vendor Advisory\"]},{\"url\":\"http://www.securityfocus.com/archive/1/500892/100/0/threaded\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"http://www.securityfocus.com/bid/33740\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"http://www.ubuntu.com/usn/USN-719-1\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"http://www.vupen.com/english/advisories/2009/0410\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"http://www.vupen.com/english/advisories/2009/0426\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"http://www.vupen.com/english/advisories/2009/0979\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A5669\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A5732\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"}],\"evaluatorComment\":\"Per vendor advisory:\\r\\n http://www.eyrie.org/~eagle/software/pam-krb5/security/2009-02-11.html\\r\\n\\r\\n\\\"This advisory is only for my pam-krb5 module, as distributed from my web site and packaged by Debian, Ubuntu, and Gentoo.\\\"\",\"vendorComments\":[{\"organization\":\"Red Hat\",\"comment\":\"Not vulnerable. This issue did not affect the versions of the pam_krb5 package, as shipped with Red Hat Enterprise Linux 2.1, 3, 4, or 5.\",\"lastModified\":\"2009-02-13T00:00:00\"}]}}"
  }
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
  • Confirmed: The vulnerability is confirmed from an analyst perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
  • Patched: This vulnerability was successfully patched by the user reporting the sighting.
  • Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
  • Not confirmed: The user expresses doubt about the veracity of the vulnerability.
  • Not patched: This vulnerability was not successfully patched by the user reporting the sighting.