PT-2009-5548 · Canonical+2 · Ubuntu+3

Russell Senior · Published 2009-09-17 · Updated 2024-02-13 · CVE-2009-3232

Positive Technologies (AI Summary)

CVSS v2.0

9.3

High

Base vector

AV:N/AC:M/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions pam-auth-update for PAM versions in Ubuntu 8.10 and 9.4, and Debian GNU/Linux (affected versions not specified)

Description The issue is related to the handling of an "empty selection" for system authentication modules in certain rare configurations. This causes any authentication attempt to be successful, allowing remote attackers to bypass authentication.

Recommendations For Ubuntu 8.10 and 9.4, and Debian GNU/Linux, at the moment, there is no information about a newer version that contains a fix for this vulnerability.

Improper Authentication

Weakness Enumeration

CWE-287

Related Identifiers

CVE-2009-3232

Affected Products

Debian

Pam

Ubuntu

Pam-Auth-Update

References · 10

• http://securityfocus.com/bid/36306 · Patch
• https://security-tracker.debian.org/tracker/CVE-2009-3232 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2009-3232 · Vendor Advisory
• http://secunia.com/advisories/36620 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2009-3232 · Security Note
• https://usn.ubuntu.com/828-1 · Vendor Advisory
• https://launchpad.net/bugs/410171 · Patch
• https://osv.dev/vulnerability/CVE-2009-3232 · Vendor Advisory
• http://openwall.com/lists/oss-security/2009/09/08/7 · Note
• http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=519927 · Note