CVE-2009-3232

pam-auth-update for PAM, as used in Ubuntu 8.10 and 9.4, and Debian GNU/Linux, does not properly handle an "empty selection" for system authentication modules in certain rare configurations, which causes any attempt to be successful and allows remote attackers to bypass authentication.

CVSS v2.0 9.3 HIGH

9.3^/10

CVSS v2.0 : HIGH

V2 Legend

Vector : AV:N/AC:M/Au:N/C:C/I:C/A:C

Exploitability : 8.6 / Impact : 10.0

Access Vector NETWORK

Access Complexity MEDIUM

Authentication NONE

Confidentiality Impact COMPLETE

Integrity Impact COMPLETE

Availability Impact COMPLETE

References

Link	Resource
http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=519927	Issue Tracking Mailing List
http://secunia.com/advisories/36620	Broken Link Vendor Advisory
http://www.openwall.com/lists/oss-security/2009/09/08/7	Mailing List
http://www.securityfocus.com/bid/36306	Broken Link Patch Third Party Advisory VDB Entry
https://launchpad.net/bugs/410171	Issue Tracking Patch
https://usn.ubuntu.com/828-1/	Broken Link
http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=519927	Issue Tracking Mailing List
http://secunia.com/advisories/36620	Broken Link Vendor Advisory
http://www.openwall.com/lists/oss-security/2009/09/08/7	Mailing List
http://www.securityfocus.com/bid/36306	Broken Link Patch Third Party Advisory VDB Entry
https://launchpad.net/bugs/410171	Issue Tracking Patch
https://usn.ubuntu.com/828-1/	Broken Link

Configurations

Configuration 1 (hide)

OR	cpe:2.3:o:canonical:ubuntu_linux:8.10:::::::*
	cpe:2.3:o:canonical:ubuntu_linux:9.04:::::::*

History

21 Nov 2024, 01:06

Type	Values Removed	Values Added
References	~~() http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=519927 - Issue Tracking, Mailing List~~	() http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=519927 - Issue Tracking, Mailing List
References	~~() http://secunia.com/advisories/36620 - Broken Link, Vendor Advisory~~	() http://secunia.com/advisories/36620 - Broken Link, Vendor Advisory
References	~~() http://www.openwall.com/lists/oss-security/2009/09/08/7 - Mailing List~~	() http://www.openwall.com/lists/oss-security/2009/09/08/7 - Mailing List
References	~~() http://www.securityfocus.com/bid/36306 - Broken Link, Patch, Third Party Advisory, VDB Entry~~	() http://www.securityfocus.com/bid/36306 - Broken Link, Patch, Third Party Advisory, VDB Entry
References	~~() https://launchpad.net/bugs/410171 - Issue Tracking, Patch~~	() https://launchpad.net/bugs/410171 - Issue Tracking, Patch
References	~~() https://usn.ubuntu.com/828-1/ - Broken Link~~	() https://usn.ubuntu.com/828-1/ - Broken Link

13 Feb 2024, 17:42

Type	Values Removed	Values Added
References	~~(UBUNTU) https://usn.ubuntu.com/828-1/ -~~	(UBUNTU) https://usn.ubuntu.com/828-1/ - Broken Link
References	~~(BID) http://www.securityfocus.com/bid/36306 - Patch~~	(BID) http://www.securityfocus.com/bid/36306 - Broken Link, Patch, Third Party Advisory, VDB Entry
References	~~(CONFIRM) http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=519927 -~~	(CONFIRM) http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=519927 - Issue Tracking, Mailing List
References	~~(CONFIRM) https://launchpad.net/bugs/410171 -~~	(CONFIRM) https://launchpad.net/bugs/410171 - Issue Tracking, Patch
References	~~(SECUNIA) http://secunia.com/advisories/36620 - Vendor Advisory~~	(SECUNIA) http://secunia.com/advisories/36620 - Broken Link, Vendor Advisory
References	~~(MLIST) http://www.openwall.com/lists/oss-security/2009/09/08/7 -~~	(MLIST) http://www.openwall.com/lists/oss-security/2009/09/08/7 - Mailing List
First Time		Canonical Canonical ubuntu Linux
CPE	cpe:2.3:o:ubuntu:ubuntu_linux:8.10:::::::* cpe:2.3:o:ubuntu:ubuntu_linux:9.04:::::::* cpe:2.3:o:debian:debian_linux::::::::	cpe:2.3:o:canonical:ubuntu_linux:8.10:::::::* cpe:2.3:o:canonical:ubuntu_linux:9.04:::::::*

Information

Published : 2009-09-17 10:30

Updated : 2024-11-21 01:06

NVD link : CVE-2009-3232

Mitre link : CVE-2009-3232

CVE.ORG link : CVE-2009-3232

JSON object : View

Products Affected

canonical

ubuntu_linux

CWE

CWE-287

Improper Authentication

9.3 /10