CVE-2009-0360
CVE-2009-0360
This page contains facts from public vulnerability sources. Check the original advisory before updating.
Russ Allbery pam-krb5 before 3.13, when linked against MIT Kerberos, does not properly initialize the Kerberos libraries for setuid use, which allows local users to gain privileges by pointing an environment variable to a modified Kerberos configuration file, and then launching a PAM-based setuid application.
EPSS 0.7% · Public exploit · Fix available
- Published
- Updated
Stack: system
Affected products and versions
n/a
- Versions
- n/a: Affected
No fix published
libpam-krb5 Debian:12
- Affected ranges
- ECOSYSTEM: < 3.13-2
Update to 3.13-2
libpam-krb5 Debian:13
- Affected ranges
- ECOSYSTEM: < 3.13-2
Update to 3.13-2
libpam-krb5 Debian:14
- Affected ranges
- ECOSYSTEM: < 3.13-2
Update to 3.13-2
Original sources
- http://secunia.com/advisories/34260
- http://sunsolve.sun.com/search/document.do?assetkey=1-66-252767-1
- https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A5732
- http://secunia.com/advisories/33914
- http://www.ubuntu.com/usn/USN-719-1
- http://www.vupen.com/english/advisories/2009/0426
- http://securitytracker.com/id?1021711
- http://www.vupen.com/english/advisories/2009/0410
- http://support.avaya.com/elmodocs2/security/ASA-2009-070.htm
- http://secunia.com/advisories/34449
- http://secunia.com/advisories/33917
- http://www.debian.org/security/2009/dsa-1721
- http://www.securityfocus.com/archive/1/500892/100/0/threaded
- http://www.eyrie.org/~eagle/software/pam-krb5/security/2009-02-11.html
- http://security.gentoo.org/glsa/glsa-200903-39.xml
- https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A5669
- http://www.securityfocus.com/bid/33740
- http://www.vupen.com/english/advisories/2009/0979
- https://nvd.nist.gov/vuln/detail/CVE-2009-0360