GSD-2009-0360
Vulnerability from gsd - Updated: 2023-12-13 01:19Details
Russ Allbery pam-krb5 before 3.13, when linked against MIT Kerberos, does not properly initialize the Kerberos libraries for setuid use, which allows local users to gain privileges by pointing an environment variable to a modified Kerberos configuration file, and then launching a PAM-based setuid application.
Aliases
Aliases
{
"GSD": {
"alias": "CVE-2009-0360",
"description": "Russ Allbery pam-krb5 before 3.13, when linked against MIT Kerberos, does not properly initialize the Kerberos libraries for setuid use, which allows local users to gain privileges by pointing an environment variable to a modified Kerberos configuration file, and then launching a PAM-based setuid application.",
"id": "GSD-2009-0360",
"references": [
"https://www.suse.com/security/cve/CVE-2009-0360.html",
"https://www.debian.org/security/2009/dsa-1721",
"https://packetstormsecurity.com/files/cve/CVE-2009-0360"
]
},
"gsd": {
"metadata": {
"exploitCode": "unknown",
"remediation": "unknown",
"reportConfidence": "confirmed",
"type": "vulnerability"
},
"osvSchema": {
"aliases": [
"CVE-2009-0360"
],
"details": "Russ Allbery pam-krb5 before 3.13, when linked against MIT Kerberos, does not properly initialize the Kerberos libraries for setuid use, which allows local users to gain privileges by pointing an environment variable to a modified Kerberos configuration file, and then launching a PAM-based setuid application.",
"id": "GSD-2009-0360",
"modified": "2023-12-13T01:19:44.190019Z",
"schema_version": "1.4.0"
}
},
"namespaces": {
"cve.org": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2009-0360",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "Russ Allbery pam-krb5 before 3.13, when linked against MIT Kerberos, does not properly initialize the Kerberos libraries for setuid use, which allows local users to gain privileges by pointing an environment variable to a modified Kerberos configuration file, and then launching a PAM-based setuid application."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "34260",
"refsource": "SECUNIA",
"url": "http://secunia.com/advisories/34260"
},
{
"name": "252767",
"refsource": "SUNALERT",
"url": "http://sunsolve.sun.com/search/document.do?assetkey=1-66-252767-1"
},
{
"name": "oval:org.mitre.oval:def:5732",
"refsource": "OVAL",
"url": "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A5732"
},
{
"name": "33914",
"refsource": "SECUNIA",
"url": "http://secunia.com/advisories/33914"
},
{
"name": "USN-719-1",
"refsource": "UBUNTU",
"url": "http://www.ubuntu.com/usn/USN-719-1"
},
{
"name": "ADV-2009-0426",
"refsource": "VUPEN",
"url": "http://www.vupen.com/english/advisories/2009/0426"
},
{
"name": "1021711",
"refsource": "SECTRACK",
"url": "http://securitytracker.com/id?1021711"
},
{
"name": "ADV-2009-0410",
"refsource": "VUPEN",
"url": "http://www.vupen.com/english/advisories/2009/0410"
},
{
"name": "http://support.avaya.com/elmodocs2/security/ASA-2009-070.htm",
"refsource": "CONFIRM",
"url": "http://support.avaya.com/elmodocs2/security/ASA-2009-070.htm"
},
{
"name": "34449",
"refsource": "SECUNIA",
"url": "http://secunia.com/advisories/34449"
},
{
"name": "33917",
"refsource": "SECUNIA",
"url": "http://secunia.com/advisories/33917"
},
{
"name": "DSA-1721",
"refsource": "DEBIAN",
"url": "http://www.debian.org/security/2009/dsa-1721"
},
{
"name": "20090211 pam-krb5 security advisory (3.12 and earlier)",
"refsource": "BUGTRAQ",
"url": "http://www.securityfocus.com/archive/1/500892/100/0/threaded"
},
{
"name": "http://www.eyrie.org/~eagle/software/pam-krb5/security/2009-02-11.html",
"refsource": "MISC",
"url": "http://www.eyrie.org/~eagle/software/pam-krb5/security/2009-02-11.html"
},
{
"name": "GLSA-200903-39",
"refsource": "GENTOO",
"url": "http://security.gentoo.org/glsa/glsa-200903-39.xml"
},
{
"name": "oval:org.mitre.oval:def:5669",
"refsource": "OVAL",
"url": "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A5669"
},
{
"name": "33740",
"refsource": "BID",
"url": "http://www.securityfocus.com/bid/33740"
},
{
"name": "ADV-2009-0979",
"refsource": "VUPEN",
"url": "http://www.vupen.com/english/advisories/2009/0979"
}
]
}
},
"nvd.nist.gov": {
"configurations": {
"CVE_data_version": "4.0",
"nodes": [
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:a:eyrie:pam-krb5:3.8:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:eyrie:pam-krb5:3.7:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:eyrie:pam-krb5:3.0:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:eyrie:pam-krb5:2.6:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:eyrie:pam-krb5:*:*:*:*:*:*:*:*",
"cpe_name": [],
"versionEndIncluding": "3.12",
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:eyrie:pam-krb5:3.11:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:eyrie:pam-krb5:3.4:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:eyrie:pam-krb5:3.3:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:eyrie:pam-krb5:2.3:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:eyrie:pam-krb5:2.2:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:eyrie:pam-krb5:3.10:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:eyrie:pam-krb5:3.9:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:eyrie:pam-krb5:3.2:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:eyrie:pam-krb5:3.1:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:eyrie:pam-krb5:2.1:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:eyrie:pam-krb5:2.0:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:eyrie:pam-krb5:3.6:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:eyrie:pam-krb5:3.5:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:eyrie:pam-krb5:2.5:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:eyrie:pam-krb5:2.4:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
}
],
"operator": "OR"
}
]
},
"cve": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2009-0360"
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "en",
"value": "Russ Allbery pam-krb5 before 3.13, when linked against MIT Kerberos, does not properly initialize the Kerberos libraries for setuid use, which allows local users to gain privileges by pointing an environment variable to a modified Kerberos configuration file, and then launching a PAM-based setuid application."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "en",
"value": "CWE-287"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "33917",
"refsource": "SECUNIA",
"tags": [
"Vendor Advisory"
],
"url": "http://secunia.com/advisories/33917"
},
{
"name": "1021711",
"refsource": "SECTRACK",
"tags": [],
"url": "http://securitytracker.com/id?1021711"
},
{
"name": "DSA-1721",
"refsource": "DEBIAN",
"tags": [],
"url": "http://www.debian.org/security/2009/dsa-1721"
},
{
"name": "33914",
"refsource": "SECUNIA",
"tags": [
"Vendor Advisory"
],
"url": "http://secunia.com/advisories/33914"
},
{
"name": "http://www.eyrie.org/~eagle/software/pam-krb5/security/2009-02-11.html",
"refsource": "MISC",
"tags": [
"Vendor Advisory"
],
"url": "http://www.eyrie.org/~eagle/software/pam-krb5/security/2009-02-11.html"
},
{
"name": "33740",
"refsource": "BID",
"tags": [],
"url": "http://www.securityfocus.com/bid/33740"
},
{
"name": "USN-719-1",
"refsource": "UBUNTU",
"tags": [],
"url": "http://www.ubuntu.com/usn/USN-719-1"
},
{
"name": "252767",
"refsource": "SUNALERT",
"tags": [],
"url": "http://sunsolve.sun.com/search/document.do?assetkey=1-66-252767-1"
},
{
"name": "34260",
"refsource": "SECUNIA",
"tags": [],
"url": "http://secunia.com/advisories/34260"
},
{
"name": "http://support.avaya.com/elmodocs2/security/ASA-2009-070.htm",
"refsource": "CONFIRM",
"tags": [],
"url": "http://support.avaya.com/elmodocs2/security/ASA-2009-070.htm"
},
{
"name": "GLSA-200903-39",
"refsource": "GENTOO",
"tags": [],
"url": "http://security.gentoo.org/glsa/glsa-200903-39.xml"
},
{
"name": "34449",
"refsource": "SECUNIA",
"tags": [],
"url": "http://secunia.com/advisories/34449"
},
{
"name": "ADV-2009-0979",
"refsource": "VUPEN",
"tags": [],
"url": "http://www.vupen.com/english/advisories/2009/0979"
},
{
"name": "ADV-2009-0426",
"refsource": "VUPEN",
"tags": [],
"url": "http://www.vupen.com/english/advisories/2009/0426"
},
{
"name": "ADV-2009-0410",
"refsource": "VUPEN",
"tags": [],
"url": "http://www.vupen.com/english/advisories/2009/0410"
},
{
"name": "oval:org.mitre.oval:def:5732",
"refsource": "OVAL",
"tags": [],
"url": "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A5732"
},
{
"name": "oval:org.mitre.oval:def:5669",
"refsource": "OVAL",
"tags": [],
"url": "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A5669"
},
{
"name": "20090211 pam-krb5 security advisory (3.12 and earlier)",
"refsource": "BUGTRAQ",
"tags": [],
"url": "http://www.securityfocus.com/archive/1/500892/100/0/threaded"
}
]
}
},
"impact": {
"baseMetricV2": {
"cvssV2": {
"accessComplexity": "HIGH",
"accessVector": "LOCAL",
"authentication": "NONE",
"availabilityImpact": "COMPLETE",
"baseScore": 6.2,
"confidentialityImpact": "COMPLETE",
"integrityImpact": "COMPLETE",
"vectorString": "AV:L/AC:H/Au:N/C:C/I:C/A:C",
"version": "2.0"
},
"exploitabilityScore": 1.9,
"impactScore": 10.0,
"obtainAllPrivilege": true,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"severity": "MEDIUM",
"userInteractionRequired": false
}
},
"lastModifiedDate": "2018-10-11T21:01Z",
"publishedDate": "2009-02-13T17:30Z"
}
}
}
Loading…
Loading…
Sightings
| Author | Source | Type | Date |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or observed by the user.
- Confirmed: The vulnerability has been validated from an analyst's perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
- Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
- Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
- Not confirmed: The user expressed doubt about the validity of the vulnerability.
- Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
Loading…
Loading…