PT-2009-1023 · Mit+1 · Mit Kerberos+1

Derek Chan + 1 · Published 2009-02-13 · Updated 2018-10-11 · CVE-2009-0360

Positive Technologies (AI Summary)

CVSS v2.0

6.2

Medium

Base vector

AV:L/AC:H/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions pam-krb5 versions prior to 3.13

Description The issue concerns multiple vulnerabilities in the libpam-krb5 package of the Debian GNU/Linux operating system. These vulnerabilities can be exploited by a local attacker to compromise the confidentiality, integrity, and availability of protected information. Specifically, when pam-krb5 is linked against MIT Kerberos and used in a setuid context, it fails to properly initialize the Kerberos libraries. This allows local users to gain privileges by modifying the Kerberos configuration file and then launching a PAM-based setuid application.

Recommendations For versions prior to 3.13, update to version 3.13 or later to resolve the issue. As a temporary workaround, consider restricting access to setuid applications that use pam-krb5 to minimize the risk of exploitation. Additionally, avoid using modified Kerberos configuration files with PAM-based setuid applications until the issue is resolved.

Exploit

Fix

Improper Authentication

Weakness Enumeration

CWE-287

Related Identifiers

BDU:2015-03045

CVE-2009-0360

DSA-1721-1

Affected Products

Mit Kerberos

Pam Krb5

References · 28

• 🔥 https://exploit-db.com/exploits/8303 · Exploit
• https://osv.dev/vulnerability/DEBIAN-CVE-2009-0360 · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-0361 · Security Note
• http://ubuntu.com/usn/USN-719-1 · Vendor Advisory
• http://debian.org/security/2009/dsa-1721 · Vendor Advisory
• https://bdu.fstec.ru/vul/2015-03045 · Security Note
• http://secunia.com/advisories/33917 · Vendor Advisory
• http://sunsolve.sun.com/search/document.do?assetkey=1-66-252767-1 · Vendor Advisory
• http://security.gentoo.org/glsa/glsa-200903-39.xml · Vendor Advisory
• http://secunia.com/advisories/33914 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2009-0360 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2009-0360 · Vendor Advisory
• http://eyrie.org/~eagle/software/pam-krb5/security/2009-02-11.html · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2009-0360 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-0360 · Security Note