VDB
CVE-2009-0360
CVE-2009-0360
PUBLISHED
CVSS 6.199999809265137 MEDIUM
Russ Allbery pam-krb5 before 3.13, when linked against MIT Kerberos, does not properly initialize the Kerberos libraries for setuid use, which allows local users to gain privileges by pointing an environment variable to a modified Kerberos configuration file, and then launching a PAM-based setuid application.
EPSS 0.69% · 52.5th percentile
Risk Scores
CVSS 2.0
6.199999809265137
EPSS Score
0.69%
52.5th percentile
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| eyrie | pam-krb5 | 3.0, 0, 2.0 |
| n/a | n/a | n/a |
Timeline
- Feb 13, 2009 CVE Published
- Mar 29, 2009 PoC Published
- Mar 29, 2009 PoC Published
- Feb 4, 2022 EPSS Score
- Mar 30, 2022 EPSS Score
- May 22, 2022 EPSS Score
- Jul 16, 2022 EPSS Score
- Sep 7, 2022 EPSS Score
- Oct 31, 2022 EPSS Score
- Dec 24, 2022 EPSS Score
- Feb 15, 2023 EPSS Score
- Mar 7, 2023 EPSS Score
References
- 33914 third-party-advisory
- USN-719-1 vendor-advisory
- 1021711 vdb
- DSA-1721 vendor-advisory
- 20090211 pam-krb5 security advisory (3.12 and earlier) mailing-list
- GLSA-200903-39 vendor-advisory
- ADV-2009-0979 vdb
- 34260 third-party-advisory
- 252767 vendor-advisory
- oval:org.mitre.oval:def:5732 vdb
- ADV-2009-0426 vdb
- ADV-2009-0410 vdb
- http://support.avaya.com/elmodocs2/security/ASA-2009-070.htm url
- 34449 third-party-advisory
- 33917 third-party-advisory
- http://www.eyrie.org/~eagle/software/pam-krb5/security/2009-02-11.html url
- oval:org.mitre.oval:def:5669 vdb
- 33740 vdb
- https://nvd.nist.gov/vuln/detail/CVE-2009-0360 advisory