CVE-2009-3232

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2009-3232
pam-auth-update for PAM, as used in Ubuntu 8.10 and 9.4, and Debian GNU/Linux, does not properly handle an "empty selection" for system authentication modules in certain rare configurations, which causes any attempt to be successful and allows remote attackers to bypass authentication.

9.3 /10

CVSS v2.0 : HIGH

V2 Legend

Vector : AV:N/AC:M/Au:N/C:C/I:C/A:C

Exploitability : 8.6 / Impact : 10.0

Access Vector NETWORK

Access Complexity MEDIUM

Authentication NONE

Confidentiality Impact COMPLETE

Integrity Impact COMPLETE

Availability Impact COMPLETE

References
Link Resource
http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=519927 Issue Tracking Mailing List
http://secunia.com/advisories/36620 Broken Link Vendor Advisory
https://launchpad.net/bugs/410171 Issue Tracking Patch
http://www.openwall.com/lists/oss-security/2009/09/08/7 Mailing List
http://www.securityfocus.com/bid/36306 Broken Link Patch Third Party Advisory VDB Entry
https://usn.ubuntu.com/828-1/ Broken Link
Configurations

Configuration 1 (hide)

OR cpe:2.3:o:canonical:ubuntu_linux:9.04:*:*:*:*:*:*:*
cpe:2.3:o:canonical:ubuntu_linux:8.10:*:*:*:*:*:*:*
History

13 Feb 2024, 17:42

Type Values Removed Values Added
References (MLIST) http://www.openwall.com/lists/oss-security/2009/09/08/7 - (MLIST) http://www.openwall.com/lists/oss-security/2009/09/08/7 - Mailing List
References (BID) http://www.securityfocus.com/bid/36306 - Patch (BID) http://www.securityfocus.com/bid/36306 - Broken Link, Patch, Third Party Advisory, VDB Entry
References (UBUNTU) https://usn.ubuntu.com/828-1/ - (UBUNTU) https://usn.ubuntu.com/828-1/ - Broken Link
References (CONFIRM) https://launchpad.net/bugs/410171 - (CONFIRM) https://launchpad.net/bugs/410171 - Issue Tracking, Patch
References (SECUNIA) http://secunia.com/advisories/36620 - Vendor Advisory (SECUNIA) http://secunia.com/advisories/36620 - Broken Link, Vendor Advisory
References (CONFIRM) http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=519927 - (CONFIRM) http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=519927 - Issue Tracking, Mailing List
First Time Canonical
Canonical ubuntu Linux
CPE cpe:2.3:o:debian:debian_linux:*:*:*:*:*:*:*:*
cpe:2.3:o:ubuntu:ubuntu_linux:9.04:*:*:*:*:*:*:*
cpe:2.3:o:ubuntu:ubuntu_linux:8.10:*:*:*:*:*:*:*		 cpe:2.3:o:canonical:ubuntu_linux:9.04:*:*:*:*:*:*:*
cpe:2.3:o:canonical:ubuntu_linux:8.10:*:*:*:*:*:*:*
Information

Published : 2009-09-17 10:30

Updated : 2024-02-13 17:42

NVD link : CVE-2009-3232

Mitre link : CVE-2009-3232

JSON object : View

Products Affected

canonical

  • ubuntu_linux
CWE
CWE-287

Improper Authentication