Vulnerability Name: | CVE-2009-3232 (CCN-53125) | ||||||||
Assigned: | 2009-09-08 | ||||||||
Published: | 2009-09-08 | ||||||||
Updated: | 2018-10-03 | ||||||||
Summary: | pam-auth-update for PAM, as used in Ubuntu 8.10 and 9.4, and Debian GNU/Linux, does not properly handle an "empty selection" for system authentication modules in certain rare configurations, which causes any attempt to be successful and allows remote attackers to bypass authentication. | ||||||||
CVSS v3 Severity: | 7.3 High (CCN CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L)
| ||||||||
CVSS v2 Severity: | 9.3 High (CVSS v2 Vector: AV:N/AC:M/Au:N/C:C/I:C/A:C) 6.9 Medium (Temporal CVSS v2 Vector: AV:N/AC:M/Au:N/C:C/I:C/A:C/E:U/RL:OF/RC:C)
5.0 Medium (CCN Temporal CVSS v2 Vector: AV:N/AC:M/Au:N/C:P/I:P/A:P/E:U/RL:OF/RC:C)
| ||||||||
Vulnerability Type: | CWE-287 | ||||||||
Vulnerability Consequences: | Gain Access | ||||||||
References: | Source: CONFIRM Type: UNKNOWN http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=519927 Source: MITRE Type: CNA CVE-2009-3232 Source: SECUNIA Type: Vendor Advisory 36620 Source: MLIST Type: UNKNOWN [oss-security] 20090908 CVE request - Debian/Ubuntu PAM auth module selection Source: CCN Type: OSVDB ID: 57908 pam-auth-update on Ubuntu Linux Authentication Bypass Source: BID Type: Patch 36306 Source: CCN Type: BID-36306 Ubuntu PAM Authentication Security Bypass Vulnerability Source: CCN Type: Ubuntu Web page Ubuntu Source: CCN Type: USN-828-1 PAM vulnerability | Ubuntu Source: XF Type: UNKNOWN pam-authmod-auth-bypass(53125) Source: CONFIRM Type: UNKNOWN https://launchpad.net/bugs/410171 Source: UBUNTU Type: UNKNOWN USN-828-1 | ||||||||
Vulnerable Configuration: | Configuration 1: Configuration CCN 1: ![]() | ||||||||
Oval Definitions | |||||||||
| |||||||||
BACK |