CVE-2009-1384

EPSS 3.33%
Veröffentlicht 28.05.2009 20:30:00
Zuletzt bearbeitet 16.06.2026 23:07:10
CVE-Watchlists
Login
Unerledigt
Login

pam_krb5 2.2.14 through 2.3.4, as used in Red Hat Enterprise Linux (RHEL) 5, generates different password prompts depending on whether the user account exists, which allows remote attackers to enumerate valid usernames.

Betroffene Produkte Warnungen 0 Metriken 2 CWE 1 Referenzen 15

NVD 3 VulnDex Vulnerability Enrichment 0

Daten sind bereitgestellt durch National Vulnerability Database (NVD)

Eyrie ≫ Pam-krb5 Version2.2.14

   Redhat ≫ Enterprise Linux Version5
   Redhat ≫ Enterprise Linux Version5 Editionclient
   Redhat ≫ Enterprise Linux Version5 Editionclient_workstation
   Redhat ≫ Enterprise Linux Version5 Editionserver

Eyrie ≫ Pam-krb5 Version2.3

Eyrie ≫ Pam-krb5 Version2.3.4

Zu dieser CVE wurde keine Warnung gefunden.

EPSS Metriken
Typ	Quelle	Score	Percentile
EPSS	FIRST.org	3.33%	0.87

CVSS Metriken
Quelle	Base Score	Exploit Score	Impact Score	Vector String
nvd@nist.gov	5	10	2.9	AV:N/AC:L/Au:N/C:P/I:N/A:N

CWE-287 Improper Authentication

When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct.

http://www.securityfocus.com/archive/1/516397/100/0/threaded

http://www.vmware.com/security/advisories/VMSA-2011-0003.html

http://secunia.com/advisories/43314

http://osvdb.org/54791

http://secunia.com/advisories/35230

http://www.mandriva.com/security/advisories?name=MDVSA-2010:054

http://www.openwall.com/lists/oss-security/2009/05/27/1

http://www.securityfocus.com/bid/35112

http://www.vupen.com/english/advisories/2009/1448

https://bugzilla.redhat.com/show_bug.cgi?id=502602

Vendor Advisory

https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A7081

https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A9652

https://nvd.nist.gov/vuln/detail/CVE-2009-1384

CVE Source (NVD)

https://cveawg.mitre.org/api/cve/CVE-2009-1384

CVE Source (JSON)

https://euvd.enisa.europa.eu/vulnerability/CVE-2009-1384

EUVD

Team-orientierte Vulnerability Management Plattform

Features der Plattform

CVE-2009-1384