NVD

Id
47693  
Name
CVE-2009-0361  
Description
Russ Allbery pam-krb5 before 3.13, as used by libpam-heimdal, su in Solaris 10, and other software, does not properly handle calls to pam_setcred when running setuid, which allows local users to overwrite and change the ownership of arbitrary files by setting the KRB5CCNAME environment variable, and then launching a setuid application that performs certain pam_setcred operations.  
Reject
 
CVSS Version
2  
CVSS Score
4.6  
Severity
Medium  
CVSS Base Score
4.6  
CVSS Impact Subscore
6.4  
CVSS Exploit Subscore
3.9  
CVSS Vector
(AV:L/AC:L/Au:N/C:P/I:P/A:P)  
Pub Date
2017-01-07  
Published
2009-02-13  
Modified Date
2011-03-07  
Seq
2009-0361  

Actions

Related NVD References

Id NVD Id NVD No. Reference Actions
239011 47693 CVE-2009-0361 oval:org.mitre.oval:def:5403  View
239012 47693 CVE-2009-0361 oval:org.mitre.oval:def:5521  View
239013 47693 CVE-2009-0361 GLSA-200903-39  View
239014 47693 CVE-2009-0361 1021711  View
239015 47693 CVE-2009-0361 252767  View
239016 47693 CVE-2009-0361 http://support.avaya.com/elmodocs2/security/ASA-2009-070.htm  View
239017 47693 CVE-2009-0361 DSA-1721  View
239018 47693 CVE-2009-0361 DSA-1722  View
239019 47693 CVE-2009-0361 http://www.eyrie.org/~eagle/software/pam-krb5/security/2009-02-11.html  View
239020 47693 CVE-2009-0361 20090211 pam-krb5 security advisory (3.12 and earlier)  View
239021 47693 CVE-2009-0361 33741  View
239022 47693 CVE-2009-0361 USN-719-1  View
239023 47693 CVE-2009-0361 ADV-2009-0410  View
239024 47693 CVE-2009-0361 ADV-2009-0426  View
239025 47693 CVE-2009-0361 ADV-2009-0979  View

Related JVN

Id Name Title Summary Cveinfo Name Cveinfo Id Nvdinfo Name Nvdinfo Id Cvssv2 Cvssv3 Jvnurl Published Date Last Updated Date Actions
40406 JVNDB-2009-001412 libpam-heimdal / Solaris 10 の su / その他の製品で使用されている pam-krb5 における任意のファイルが改ざんされる脆弱性 libpam-heimdal / Solaris 10 の su / その他の製品で使用されている pam-krb5 には、setuidが実行されている場合、pam_setcred を呼び出す処理が適切でないため、任意のファイルの所有権を上書きされるおよび変更される脆弱性が存在します。 CVE-2009-0361 37792 CVE-2009-0361 47693 4.6 http://jvndb.jvn.jp/ja/contents/2009/JVNDB-2009-001412.html 2009-02-13 2009-06-30 View