4.6

CVE-2009-0361

Russ Allbery pam-krb5 before 3.13, as used by libpam-heimdal, su in Solaris 10, and other software, does not properly handle calls to pam_setcred when running setuid, which allows local users to overwrite and change the ownership of arbitrary files by setting the KRB5CCNAME environment variable, and then launching a setuid application that performs certain pam_setcred operations.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Eyrie ≫ Pam-krb5 Version <= 3.12
Eyrie ≫ Pam-krb5 Version3.0
Eyrie ≫ Pam-krb5 Version3.1
Eyrie ≫ Pam-krb5 Version3.2
Eyrie ≫ Pam-krb5 Version3.3
Eyrie ≫ Pam-krb5 Version3.4
Eyrie ≫ Pam-krb5 Version3.5
Eyrie ≫ Pam-krb5 Version3.6
Eyrie ≫ Pam-krb5 Version3.7
Eyrie ≫ Pam-krb5 Version3.8
Eyrie ≫ Pam-krb5 Version3.9
Eyrie ≫ Pam-krb5 Version3.10
Eyrie ≫ Pam-krb5 Version3.11
Zu dieser CVE wurde keine CISA KEV oder CERT.AT-Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 0.07% 0.184
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
nvd@nist.gov 4.6 3.9 6.4
AV:L/AC:L/Au:N/C:P/I:P/A:P
Es wurden noch keine Informationen zu CWE veröffentlicht.