CVE-2009-3232 pam-auth-update for PAM, as used in Ubuntu 8.10 and 9.4, and Debian GNU/Linux, does not properly handle an "empty selection" for system authentication modules in certain rare configurations, which cau...
HighCVSS 9.3
EPSS 4.6%
- Published
- Updated
- Exploit status
- No public exploit known
Description
pam-auth-update for PAM, as used in Ubuntu 8.10 and 9.4, and Debian GNU/Linux, does not properly handle an "empty selection" for system authentication modules in certain rare configurations, which causes any attempt to be successful and allows remote attackers to bypass authentication.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| Canonical Ubuntu Linux | = 8.10 | No fix listed |
| Canonical Ubuntu Linux | = 9.04 | No fix listed |
| debian/pam(Debian:12) | < 1.0.1-10 | 1.0.1-10 |
| debian/pam(Debian:13) | < 1.0.1-10 | 1.0.1-10 |
| debian/pam(Debian:14) | < 1.0.1-10 | 1.0.1-10 |
References
- bugs.debian.org issue-tracking mailing-list
- 36620 broken-link third-party-advisory vendor-advisory
- [oss-security] 20090908 CVE request - Debian/Ubuntu PAM auth module selection mailing-list
- 36306 broken-link patch third-party-advisory vdb-entry
- launchpad.net issue-tracking patch
- USN-828-1 broken-link vendor-advisory
- Debian Security Tracker CVE-2009-3232 vendor-advisory
- bugs.debian.org issue-tracking