PT-2009-1024 · Mit · Pam Krb5+1

Derek Chan · Published 2009-02-13 · Updated 2018-10-11 · CVE-2009-0361

Positive Technologies (AI Summary)

CVSS v2.0

6.2

Medium

Base vector

AV:L/AC:H/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions libpam-krb5 versions prior to 3.13 pam-krb5 versions prior to 3.13

Description The issue concerns multiple vulnerabilities in the libpam-krb5 package, which can be exploited by a local attacker to compromise the confidentiality, integrity, and availability of protected information. Specifically, the vulnerability allows local users to overwrite and change the ownership of arbitrary files by setting the KRB5CCNAME environment variable and then launching a setuid application that performs certain pam setcred operations.

Recommendations For libpam-krb5 versions prior to 3.13, update to version 3.13 or later to resolve the issue. For pam-krb5 versions prior to 3.13, update to version 3.13 or later to resolve the issue. As a temporary workaround, consider restricting the use of the pam setcred operation in setuid applications to minimize the risk of exploitation.

Fix

Improper Authentication

Weakness Enumeration

CWE-287

CWE-264

Related Identifiers

BDU:2015-03045

CVE-2009-0361

DSA-1721-1

DSA-1722-1

Affected Products

Libpam-Krb5

Pam Krb5

References · 29

• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-0361 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2009-0361 · Security Note
• https://security-tracker.debian.org/tracker/CVE-2009-0361 · Vendor Advisory
• http://ubuntu.com/usn/USN-719-1 · Vendor Advisory
• http://debian.org/security/2009/dsa-1721 · Vendor Advisory
• https://bdu.fstec.ru/vul/2015-03045 · Security Note
• http://secunia.com/advisories/33917 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2009-0361 · Vendor Advisory
• http://sunsolve.sun.com/search/document.do?assetkey=1-66-252767-1 · Vendor Advisory
• http://security.gentoo.org/glsa/glsa-200903-39.xml · Vendor Advisory
• http://secunia.com/advisories/33914 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2009-0361 · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-0360 · Security Note
• http://secunia.com/advisories/33918 · Vendor Advisory
• http://debian.org/security/2009/dsa-1722 · Vendor Advisory