VDB
CVE-2009-0360
CVE-2009-0360
PUBLISHED
CVSS 6.199999809265137 MEDIUM
Russ Allbery pam-krb5 before 3.13, when linked against MIT Kerberos, does not properly initialize the Kerberos libraries for setuid use, which allows local users to gain privileges by pointing an environment variable to a modified Kerberos configuration file, and then launching a PAM-based setuid application.
EPSS 0.25% · 48.5th percentile
Risk Scores
CVSS 2.0
6.199999809265137
EPSS Score
0.25%
48.5th percentile
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| eyrie | pam-krb5 | 3.0, 0, 2.0 |
| n/a | n/a | n/a |
Timeline
- Feb 13, 2009 CVE Published
- Mar 29, 2009 PoC Published
- Mar 29, 2009 PoC Published
- Feb 4, 2022 EPSS Score
- Mar 29, 2022 EPSS Score
- May 20, 2022 EPSS Score
- Jul 12, 2022 EPSS Score
- Sep 4, 2022 EPSS Score
- Oct 26, 2022 EPSS Score
- Dec 18, 2022 EPSS Score
- Feb 9, 2023 EPSS Score
- Mar 7, 2023 EPSS Score
References
- 34260 third-party-advisory
- 252767 vendor-advisory
- oval:org.mitre.oval:def:5732 vdb
- 33914 third-party-advisory
- USN-719-1 vendor-advisory
- ADV-2009-0426 vdb
- 1021711 vdb
- ADV-2009-0410 vdb
- http://support.avaya.com/elmodocs2/security/ASA-2009-070.htm url
- 34449 third-party-advisory
- 33917 third-party-advisory
- DSA-1721 vendor-advisory
- 20090211 pam-krb5 security advisory (3.12 and earlier) mailing-list
- http://www.eyrie.org/~eagle/software/pam-krb5/security/2009-02-11.html url
- GLSA-200903-39 vendor-advisory
- oval:org.mitre.oval:def:5669 vdb
- 33740 vdb
- ADV-2009-0979 vdb
- https://nvd.nist.gov/vuln/detail/CVE-2009-0360 advisory