CVE-2009-0360

🗓️ 13 Feb 2009 17:00:00Reported by mitreType

cve🔗 web.nvd.nist.gov👁 57 Views🌐 WEB

Russ Allbery pam-krb5 before 3.13 does not initialize Kerberos libraries properly, allowing local users to gain privileges

Reporter	Title	Published	Views	Family All 40
0day.today	pam-krb5 < 3.13 Local Privilege Escalation Exploit	29 Mar 200900:00	–	zdt
Circl	CVE-2009-0360	29 Mar 200900:00	–	circl
Cvelist	CVE-2009-0360	13 Feb 200917:00	–	cvelist
Debian	[SECURITY] [DSA 1721-1] New libpam-krb5 packages fix local privilege escalation	11 Feb 200920:58	–	debian
Debian CVE	CVE-2009-0360	13 Feb 200917:00	–	debiancve
Tenable Nessus	Debian DSA-1721-1 : libpam-krb5 - several vulnerabilities	13 Feb 200900:00	–	nessus
Tenable Nessus	Debian DSA-1722-1 : libpam-heimdal - programming error	13 Feb 200900:00	–	nessus
Tenable Nessus	GLSA-200903-39 : pam_krb5: Privilege escalation	27 Mar 200900:00	–	nessus
Tenable Nessus	GLSA-201412-08 : Multiple packages, Multiple vulnerabilities fixed in 2010	15 Dec 201400:00	–	nessus
Tenable Nessus	Solaris 10 (sparc) : 138371-06	17 Dec 200800:00	–	nessus

NVD

Node

Source	Link
vupen	www.vupen.com/english/advisories/2009/0410
oval	www.oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A5732
oval	www.oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A5669
secunia	www.secunia.com/advisories/33914
support	www.support.avaya.com/elmodocs2/security/ASA-2009-070.htm
security	www.security.gentoo.org/glsa/glsa-200903-39.xml
vupen	www.vupen.com/english/advisories/2009/0426
debian	www.debian.org/security/2009/dsa-1721
eyrie	www.eyrie.org/~eagle/software/pam-krb5/security/2009-02-11.html
securityfocus	www.securityfocus.com/bid/33740

Parameter	Position	Path	Description	CWE
krb5.conf	path	/tmp/cve-2009-0360/krb5.conf	Kerberos configuration file used by exploit to configure fake KDC and realm for privilege escalation	CWE-287
kdc.conf	path	/tmp/cve-2009-0360/kdc.conf	KDC configuration file used by exploit to start fake Kerberos server	CWE-287
principal	path	/tmp/cve-2009-0360/principal	Kerberos database principal file path created by exploit	CWE-287

23 Apr 2026 00:35Current

8.8High risk

Vulners AI Score8.8

CVSS 26.2

EPSS0.0025