NVD

Id
47692  
Name
CVE-2009-0360  
Description
Russ Allbery pam-krb5 before 3.13, when linked against MIT Kerberos, does not properly initialize the Kerberos libraries for setuid use, which allows local users to gain privileges by pointing an environment variable to a modified Kerberos configuration file, and then launching a PAM-based setuid application.  
Reject
 
CVSS Version
2  
CVSS Score
6.2  
Severity
Medium  
CVSS Base Score
6.2  
CVSS Impact Subscore
10  
CVSS Exploit Subscore
1.9  
CVSS Vector
(AV:L/AC:H/Au:N/C:C/I:C/A:C)  
Pub Date
2017-01-07  
Published
2009-02-13  
Modified Date
2011-03-07  
Seq
2009-0360  

Actions

Related NVD References

Id NVD Id NVD No. Reference Actions
238997 47692 CVE-2009-0360 oval:org.mitre.oval:def:5669  View
238998 47692 CVE-2009-0360 oval:org.mitre.oval:def:5732  View
238999 47692 CVE-2009-0360 GLSA-200903-39  View
239000 47692 CVE-2009-0360 1021711  View
239001 47692 CVE-2009-0360 252767  View
239002 47692 CVE-2009-0360 http://support.avaya.com/elmodocs2/security/ASA-2009-070.htm  View
239003 47692 CVE-2009-0360 DSA-1721  View
239004 47692 CVE-2009-0360 http://www.eyrie.org/~eagle/software/pam-krb5/security/2009-02-11.html  View
239005 47692 CVE-2009-0360 20090211 pam-krb5 security advisory (3.12 and earlier)  View
239006 47692 CVE-2009-0360 33740  View
239007 47692 CVE-2009-0360 USN-719-1  View
239008 47692 CVE-2009-0360 ADV-2009-0410  View
239009 47692 CVE-2009-0360 ADV-2009-0426  View
239010 47692 CVE-2009-0360 ADV-2009-0979  View

Related JVN

Id Name Title Summary Cveinfo Name Cveinfo Id Nvdinfo Name Nvdinfo Id Cvssv2 Cvssv3 Jvnurl Published Date Last Updated Date Actions
40407 JVNDB-2009-001413 pam-krb5 における権限昇格の脆弱性 pam-krb5 には、MIT Kerberos に対してリンクされている場合、setuid するための Kerberos ライブラリが適切に初期化されていないため、権限を取得される脆弱性が存在します。 CVE-2009-0360 37791 CVE-2009-0360 47692 6.2 http://jvndb.jvn.jp/ja/contents/2009/JVNDB-2009-001413.html 2009-02-13 2009-06-30 View