CVE-2009-3232: Critical severity ubuntu vulnerability
Published Sep 17, 2009
·Updated
pam-auth-update for PAM, as used in Ubuntu 8.10 and 9.4, and Debian GNU/Linux, does not properly handle an "empty selection" for system authentication modules in certain rare configurations, which causes any attempt to be successful and allows remote attackers to bypass authentication.
Affected Software
5 affected components
Canonical Ubuntu Linux=8.10
Canonical Ubuntu Linux=9.04
Ubuntu Ubuntu Linux=8.10
Debian Debian Linux
Ubuntu Ubuntu Linux=9.04
Remediation
Patch Available
Patch Available
Event History
Sep 17, 2009
CVE Published
via MITRE·10:00 AM
Data Sourced
via MITRE·10:00 AM
Description
Frequently Asked Questions
1
What is the severity of CVE-2009-3232?
CVE-2009-3232 has a high severity level due to its ability to allow remote attackers to bypass system authentication.
2
How do I fix CVE-2009-3232?
To fix CVE-2009-3232, you should update your PAM configuration and ensure proper authentication modules are selected.
3
Which versions of Ubuntu are affected by CVE-2009-3232?
CVE-2009-3232 affects Ubuntu versions 8.10 and 9.04.
4
Is Debian also affected by CVE-2009-3232?
Yes, Debian GNU/Linux is affected by CVE-2009-3232 in certain configurations.
5
What types of attacks does CVE-2009-3232 allow?
CVE-2009-3232 allows remote attackers to authenticate successfully without proper credentials.