CVE-2009-0360: Medium severity Eyrie Pam-krb5 vulnerability
Russ Allbery pam-krb5 before 3.13, when linked against MIT Kerberos, does not properly initialize the Kerberos libraries for setuid use, which allows local users to gain privileges by pointing an environment variable to a modified Kerberos configuration file, and then launching a PAM-based setuid application.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
pam-krb5to a version that resolves this vulnerability.Fixed in 3.13
Event History
Frequently Asked Questions
What is the severity of CVE-2009-0360?
CVE-2009-0360 is considered a high severity vulnerability due to its potential to allow local users to gain elevated privileges.
How do I fix CVE-2009-0360?
To fix CVE-2009-0360, upgrade to pam-krb5 version 3.13 or later, which properly initializes the Kerberos libraries for setuid use.
Who is affected by CVE-2009-0360?
CVE-2009-0360 affects users of pam-krb5 versions prior to 3.13 when linked against MIT Kerberos.
What can attackers do with CVE-2009-0360?
Attackers can exploit CVE-2009-0360 by manipulating an environment variable to point to a modified Kerberos configuration file, enabling privilege escalation.
Is CVE-2009-0360 a remote vulnerability?
No, CVE-2009-0360 is a local vulnerability that requires access to the system to exploit.