2023-04-24 12:24:31 +02:00
{
"id" : "CVE-2009-0361" ,
"sourceIdentifier" : "cve@mitre.org" ,
"published" : "2009-02-13T17:30:00.687" ,
"lastModified" : "2018-10-11T21:01:26.663" ,
"vulnStatus" : "Modified" ,
2024-07-14 02:06:08 +00:00
"cveTags" : [ ] ,
2023-04-24 12:24:31 +02:00
"descriptions" : [
{
"lang" : "en" ,
"value" : "Russ Allbery pam-krb5 before 3.13, as used by libpam-heimdal, su in Solaris 10, and other software, does not properly handle calls to pam_setcred when running setuid, which allows local users to overwrite and change the ownership of arbitrary files by setting the KRB5CCNAME environment variable, and then launching a setuid application that performs certain pam_setcred operations."
} ,
{
"lang" : "es" ,
"value" : "Russ Allbery pam-krb5 versiones anteriores a v3.13, como el usado por libpam-heimdal, el comando \"su\" en Solaris 10, y otros programas, no gestiona correctamente las peticiones a \"pam_setcred\" al ejecutar \"setuid\", permitiendo a usuarios locales sobreescribir y cambiar los propietarios de los ficheros que elijan al asignarle un valor a la variable de entorno \"KRB5CCNAME\", y despu\u00e9s invocar la aplicaci\u00f3n setuid que efect\u00faa ciertas operaciones \"pam_setcred\"."
}
] ,
"vendorComments" : [
{
"organization" : "Red Hat" ,
"comment" : "Not vulnerable. This issue did not affect the versions of the pam_krb5 package, as shipped with Red Hat Enterprise Linux 2.1, 3, 4, or 5." ,
"lastModified" : "2009-02-13T00:00:00"
}
] ,
"metrics" : {
"cvssMetricV2" : [
{
"source" : "nvd@nist.gov" ,
"type" : "Primary" ,
"cvssData" : {
"version" : "2.0" ,
"vectorString" : "AV:L/AC:L/Au:N/C:P/I:P/A:P" ,
"accessVector" : "LOCAL" ,
"accessComplexity" : "LOW" ,
"authentication" : "NONE" ,
"confidentialityImpact" : "PARTIAL" ,
"integrityImpact" : "PARTIAL" ,
"availabilityImpact" : "PARTIAL" ,
"baseScore" : 4.6
} ,
"baseSeverity" : "MEDIUM" ,
"exploitabilityScore" : 3.9 ,
"impactScore" : 6.4 ,
"acInsufInfo" : false ,
"obtainAllPrivilege" : false ,
"obtainUserPrivilege" : false ,
"obtainOtherPrivilege" : true ,
"userInteractionRequired" : false
}
]
} ,
"weaknesses" : [
{
"source" : "nvd@nist.gov" ,
"type" : "Primary" ,
"description" : [
{
"lang" : "en" ,
"value" : "CWE-264"
}
]
}
] ,
"configurations" : [
{
"nodes" : [
{
"operator" : "OR" ,
"negate" : false ,
"cpeMatch" : [
{
"vulnerable" : true ,
"criteria" : "cpe:2.3:a:eyrie:pam-krb5:*:*:*:*:*:*:*:*" ,
"versionEndIncluding" : "3.12" ,
"matchCriteriaId" : "989241C8-BC2F-4DE2-BF9E-9CC64198AF5A"
} ,
{
"vulnerable" : true ,
"criteria" : "cpe:2.3:a:eyrie:pam-krb5:3.0:*:*:*:*:*:*:*" ,
"matchCriteriaId" : "633EE1E7-1B5D-4D10-BA4B-D13A15BA68B2"
} ,
{
"vulnerable" : true ,
"criteria" : "cpe:2.3:a:eyrie:pam-krb5:3.1:*:*:*:*:*:*:*" ,
"matchCriteriaId" : "4B6844EE-3552-429A-A3D8-9A6B6C3B2785"
} ,
{
"vulnerable" : true ,
"criteria" : "cpe:2.3:a:eyrie:pam-krb5:3.2:*:*:*:*:*:*:*" ,
"matchCriteriaId" : "D9619E40-83AA-46D6-AECF-CC7FF6B1ED1B"
} ,
{
"vulnerable" : true ,
"criteria" : "cpe:2.3:a:eyrie:pam-krb5:3.3:*:*:*:*:*:*:*" ,
"matchCriteriaId" : "1FF1D6C7-15E6-4DAA-92C1-C216905866B4"
} ,
{
"vulnerable" : true ,
"criteria" : "cpe:2.3:a:eyrie:pam-krb5:3.4:*:*:*:*:*:*:*" ,
"matchCriteriaId" : "BB0342E5-B622-4A5E-A57F-6EAF85E268C1"
} ,
{
"vulnerable" : true ,
"criteria" : "cpe:2.3:a:eyrie:pam-krb5:3.5:*:*:*:*:*:*:*" ,
"matchCriteriaId" : "B2684C7D-B266-4460-9DAD-945B4DECF57C"
} ,
{
"vulnerable" : true ,
"criteria" : "cpe:2.3:a:eyrie:pam-krb5:3.6:*:*:*:*:*:*:*" ,
"matchCriteriaId" : "FDC110CB-253F-44E6-8515-FC9025EBF57F"
} ,
{
"vulnerable" : true ,
"criteria" : "cpe:2.3:a:eyrie:pam-krb5:3.7:*:*:*:*:*:*:*" ,
"matchCriteriaId" : "D78AEED8-34AB-41B7-926F-6F7995253E5A"
} ,
{
"vulnerable" : true ,
"criteria" : "cpe:2.3:a:eyrie:pam-krb5:3.8:*:*:*:*:*:*:*" ,
"matchCriteriaId" : "FB53833E-EB9E-4ED8-8BC5-B681BE0B2897"
} ,
{
"vulnerable" : true ,
"criteria" : "cpe:2.3:a:eyrie:pam-krb5:3.9:*:*:*:*:*:*:*" ,
"matchCriteriaId" : "0FE72618-6BE5-45F3-A782-991A73C09389"
} ,
{
"vulnerable" : true ,
"criteria" : "cpe:2.3:a:eyrie:pam-krb5:3.10:*:*:*:*:*:*:*" ,
"matchCriteriaId" : "315E2FB7-EEE5-48AA-B058-F53AEA210807"
} ,
{
"vulnerable" : true ,
"criteria" : "cpe:2.3:a:eyrie:pam-krb5:3.11:*:*:*:*:*:*:*" ,
"matchCriteriaId" : "A4421B50-CC46-4EA6-AACF-DBE0EE76A389"
}
]
}
]
}
] ,
"references" : [
2024-04-04 08:46:00 +00:00
{
"url" : "http://secunia.com/advisories/33914" ,
"source" : "cve@mitre.org" ,
"tags" : [
"Vendor Advisory"
]
} ,
{
"url" : "http://secunia.com/advisories/33917" ,
"source" : "cve@mitre.org" ,
"tags" : [
"Vendor Advisory"
]
} ,
{
"url" : "http://secunia.com/advisories/33918" ,
"source" : "cve@mitre.org" ,
"tags" : [
"Vendor Advisory"
]
} ,
{
"url" : "http://secunia.com/advisories/34260" ,
"source" : "cve@mitre.org"
} ,
{
"url" : "http://secunia.com/advisories/34449" ,
"source" : "cve@mitre.org"
} ,
2023-04-24 12:24:31 +02:00
{
"url" : "http://security.gentoo.org/glsa/glsa-200903-39.xml" ,
"source" : "cve@mitre.org"
} ,
{
"url" : "http://securitytracker.com/id?1021711" ,
"source" : "cve@mitre.org"
} ,
{
"url" : "http://sunsolve.sun.com/search/document.do?assetkey=1-66-252767-1" ,
"source" : "cve@mitre.org"
} ,
{
"url" : "http://support.avaya.com/elmodocs2/security/ASA-2009-070.htm" ,
"source" : "cve@mitre.org"
} ,
{
"url" : "http://www.debian.org/security/2009/dsa-1721" ,
"source" : "cve@mitre.org"
} ,
{
"url" : "http://www.debian.org/security/2009/dsa-1722" ,
"source" : "cve@mitre.org"
} ,
{
"url" : "http://www.eyrie.org/~eagle/software/pam-krb5/security/2009-02-11.html" ,
"source" : "cve@mitre.org"
} ,
{
"url" : "http://www.securityfocus.com/archive/1/500892/100/0/threaded" ,
"source" : "cve@mitre.org"
} ,
{
"url" : "http://www.securityfocus.com/bid/33741" ,
"source" : "cve@mitre.org"
} ,
{
"url" : "http://www.ubuntu.com/usn/USN-719-1" ,
"source" : "cve@mitre.org"
} ,
{
"url" : "http://www.vupen.com/english/advisories/2009/0410" ,
"source" : "cve@mitre.org"
} ,
{
"url" : "http://www.vupen.com/english/advisories/2009/0426" ,
"source" : "cve@mitre.org"
} ,
{
"url" : "http://www.vupen.com/english/advisories/2009/0979" ,
"source" : "cve@mitre.org"
} ,
{
"url" : "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A5403" ,
"source" : "cve@mitre.org"
} ,
{
"url" : "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A5521" ,
"source" : "cve@mitre.org"
}
]
}
