PT-2009-4889 · Openpam+1 · Openam+1

Published 2009-07-16 · Updated 2017-08-17 · CVE-2009-2482

Positive Technologies (AI Summary)

CVSS v2.0

6.9

Medium

Base vector

AV:L/AC:M/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions NetBSD versions 4.0 through 4.0.1 NetBSD versions 5.0 through 5.0.0

Description The issue allows local users to change the current root password if it is already known, even when they are not in the wheel group, due to a problem in the pam unix module in OpenPAM.

Recommendations For NetBSD versions 4.0 through 4.0.1, update to version 4.0.2 or later. For NetBSD versions 5.0 through 5.0.0, update to version 5.0.1 or later.

Fix

Weakness Enumeration

CWE-264

Related Identifiers

CVE-2009-2482

Affected Products

Netbsd

Openam

References · 7

• ftp://ftp.netbsd.org/pub/NetBSD/security/advisories/NetBSD-SA2009-004.txt.asc · Vendor Advisory
• http://secunia.com/advisories/35553 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2009-2482 · Security Note
• http://osvdb.org/55284 · Note
• http://securityfocus.com/bid/35465 · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/51312 · Note
• http://securitytracker.com/id?1022432 · Note