CVE-2009-0360

6 known exploits for CVE-2009-0360

Russ Allbery pam-krb5 before 3.13, when linked against MIT Kerberos, does not properly initialize the Kerberos libraries for setuid use, which allows local users to gain privileges by pointing an environment variable to a modified Kerberos configuration file, and then launching a PAM-based setuid application.

Affected products: Mit Kerberos, Pam Krb5
Eyrie pam-krb5: ≤ 3.12, 2.0, 2.1, 2.2, 2.3, 2.4, 2.5, 2.6, 3.0, 3.1, 3.2, 3.3, 3.4, 3.5, 3.6, 3.7, 3.8, 3.9, 3.10, 3.11

Fix: Available
CVSS 2.0: 6.2 MEDIUM
EPSS: 0.7% (51th percentile)
Weakness: CWE-287
NVD status: Modified
Published: 2009-02-13

CVE-2009-0360 at NVD

Authoritative description, scoring and affected products

pam-krb5 < 3.13 Local Privilege Escalation Exploit

2014-07-01 RootSEEBUG

pam-krb5 < 3.13 Local Privilege Escalation Exploit

2009-03-30 RootSEEBUG

pam-krb5 < 3.13 Local Privilege Escalation Exploit

2009-03-29 Jon OberheideZDTC

pam-krb5 3.13 - Local Privilege Escalation

2009-03-29 Jon OberheideEXPLOITPACKC

pam-krb5 < 3.13 - Local Privilege Escalation

2009-03-29 Jon OberheideEXPLOITDBC

pam-krb5 API使用本地权限提升漏洞

2009-02-13 RootSEEBUG