9.3

CVE-2009-3232

pam-auth-update for PAM, as used in Ubuntu 8.10 and 9.4, and Debian GNU/Linux, does not properly handle an "empty selection" for system authentication modules in certain rare configurations, which causes any attempt to be successful and allows remote attackers to bypass authentication.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Canonical ≫ Ubuntu Linux Version8.10
Canonical ≫ Ubuntu Linux Version9.04
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 4.61% 0.905
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
nvd@nist.gov 9.3 8.6 10
AV:N/AC:M/Au:N/C:C/I:C/A:C
CWE-287 Improper Authentication

When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct.

http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=519927
Mailing List
Issue Tracking
http://secunia.com/advisories/36620
Vendor Advisory
Broken Link
http://www.openwall.com/lists/oss-security/2009/09/08/7
Mailing List
http://www.securityfocus.com/bid/36306
Patch
Third Party Advisory
Broken Link
VDB Entry
https://launchpad.net/bugs/410171
Patch
Issue Tracking
https://usn.ubuntu.com/828-1/
Broken Link