EUVD-2003-0681

Malware in sbrugna...

DEBIAN-CVE-2009-0361

Russ Allbery pam-krb5 before 3.13, as used by libpam-heimdal, su in Solaris 10, and other software, does not properly handle calls to pamsetcred when running setuid, which allows local users to overwrite and change the ownership of arbitrary files by setting the KRB5CCNAME environment variable, a...

CVE-2009-0361

CVE-2009-0361 concerns pam_krb5 in libpam-krb5 and related components. Concrete details in connected documents show that pam_krb5 fails to handle pam_setcred correctly when a process runs setuid, enabling a local user to create or modify arbitrary files by setting the KRB5CCNAME environment varia...

Mandrake Linux Security Advisory : kdebase (MDKSA-2003:091)

A vulnerability was discovered in all versions of KDE 2.2.0 up to and including 3.1.3. KDM does not check for successful completion of the pamsetcred call and in the case of error conditions in the installed PAM modules, KDM may grant local root access to any user with valid login credentials. It...

Mandrake Linux Security Advisory : XFree86 (MDKSA-2003:118)

A vulnerability was discovered in the XDM display manager that ships with XFree86. XDM does not check for successful completion of the pamsetcred call and in the case of error conditions in the installed PAM modules, XDM may grant local root access to any user with valid login credentials. It has...

CVE-2003-0690

KDM in KDE 3.1.3 and earlier does not verify whether the pamsetcred function call succeeds, which may allow attackers to gain root privileges by triggering error conditions within PAM modules, as demonstrated in certain configurations of the MIT pamkrb5 module...

CVE-2003-0690

KDM in KDE 3.1.3 and earlier does not verify whether the pamsetcred function call succeeds, which may allow attackers to gain root privileges by triggering error conditions within PAM modules, as demonstrated in certain configurations of the MIT pamkrb5 module...

CVE-2003-0690

Concretely, CVE-2003-0690 affects KDE kdebase (KDM in KDE 3.1.3 and earlier). The flaw is that kdebase does not verify whether pam_setcred succeeds, which can allow a root privilege escalation under certain PAM module configurations (notably MIT pam_krb5). Public sources in connected docs referen...