CVE-2003-0690

2003-10-0604:00:00

NVD-CWE-Other

[email protected]

web.nvd.nist.gov

cve-2003-0690

kde

kdm

pam_setcred

root privileges

pam modules

mit pam_krb5 module

6.4 Medium

AI Score

Confidence

Low

10 High

CVSS2

Access Vector

NETWORK

Access Complexity

LOW

Authentication

NONE

Confidentiality Impact

COMPLETE

Integrity Impact

COMPLETE

Availability Impact

COMPLETE

AV:N/AC:L/Au:N/C:C/I:C/A:C

0.008 Low

EPSS

Percentile

81.9%

JSON

KDM in KDE 3.1.3 and earlier does not verify whether the pam_setcred function call succeeds, which may allow attackers to gain root privileges by triggering error conditions within PAM modules, as demonstrated in certain configurations of the MIT pam_krb5 module.

CPENameOperatorVersion
kde:kdekdeeq2.2.1
kde:kdekdeeq2.1.2
kde:kdekdeeq2.0
kde:kdekdeeq3.0.2
kde:kdekdeeq3.0.5
kde:kdekdeeq2.0_beta
kde:kdekdeeq2.2
kde:kdekdeeq3.1.1a
kde:kdekdeeq2.0.1
kde:kdekdeeq3.0.5b

CPE	Name	Operator	Version
kde:kde	kde	eq	2.2.1
kde:kde	kde	eq	2.1.2
kde:kde	kde	eq	2.0
kde:kde	kde	eq	3.0.2
kde:kde	kde	eq	3.0.5
kde:kde	kde	eq	2.0_beta
kde:kde	kde	eq	2.2
kde:kde	kde	eq	3.1.1a
kde:kde	kde	eq	2.0.1
kde:kde	kde	eq	3.0.5b