Rapid7 Vulnerability & Exploit Database

Gentoo Linux: CVE-2009-0360: pam_krb5: Privilege escalation

Free InsightVM Trial No credit card necessary

Watch Demo See how it all works

Back to Search

Gentoo Linux: CVE-2009-0360: pam_krb5: Privilege escalation

Severity

CVSS

(AV:L/AC:H/Au:N/C:C/I:C/A:C)

Published

02/13/2009

Created

07/25/2018

Added

10/30/2017

Modified

06/15/2020

Description

Russ Allbery pam-krb5 before 3.13, when linked against MIT Kerberos, does not properly initialize the Kerberos libraries for setuid use, which allows local users to gain privileges by pointing an environment variable to a modified Kerberos configuration file, and then launching a PAM-based setuid application.

Solution(s)

gentoo-linux-upgrade-app-antivirus-bitdefender-console
gentoo-linux-upgrade-app-arch-gzip
gentoo-linux-upgrade-app-arch-ncompress
gentoo-linux-upgrade-app-misc-beanstalkd
gentoo-linux-upgrade-app-text-dvipng
gentoo-linux-upgrade-app-text-gv
gentoo-linux-upgrade-dev-lang-tk
gentoo-linux-upgrade-dev-libs-liblzw
gentoo-linux-upgrade-dev-perl-perl-tk
gentoo-linux-upgrade-dev-util-insight
gentoo-linux-upgrade-dev-util-sourcenav
gentoo-linux-upgrade-kde-base-kdm
gentoo-linux-upgrade-kde-base-kget
gentoo-linux-upgrade-media-gfx-splashutils
gentoo-linux-upgrade-media-tv-dvbstreamer
gentoo-linux-upgrade-net-ftp-lftp
gentoo-linux-upgrade-net-mail-mlmmj
gentoo-linux-upgrade-net-misc-iputils
gentoo-linux-upgrade-sys-apps-acl
gentoo-linux-upgrade-sys-apps-pmount
gentoo-linux-upgrade-sys-auth-pam_krb5
gentoo-linux-upgrade-sys-block-partimage
gentoo-linux-upgrade-sys-devel-m4
gentoo-linux-upgrade-www-client-uzbl
gentoo-linux-upgrade-x11-apps-xinit
gentoo-linux-upgrade-x11-libs-gtk
gentoo-linux-upgrade-x11-misc-slim

References

https://attackerkb.com/topics/cve-2009-0360
33740
CVE - 2009-0360
DSA-1721
200903-39
201412-08
OVAL5669
OVAL5732

Advanced vulnerability management analytics and reporting.

Key Features

Free InsightVM Trial View All Features

With Rapid7 live dashboards, I have a clear view of all the assets on my network, which ones can be exploited, and what I need to do in order to reduce the risk in my environment in real-time. No other tool gives us that kind of value and insight.

– Scott Cheney, Manager of Information Security, Sierra View Medical Center

;