CVE-2009-0361

Publication date 13 February 2009

Last updated 24 July 2024

Ubuntu priority

Low

Why this priority?

Russ Allbery pam-krb5 before 3.13, as used by libpam-heimdal, su in Solaris 10, and other software, does not properly handle calls to pam_setcred when running setuid, which allows local users to overwrite and change the ownership of arbitrary files by setting the KRB5CCNAME environment variable, and then launching a setuid application that performs certain pam_setcred operations.

Status

No maintained releases are affected by this CVE.

Package Ubuntu Release Status
libpam-heimdal 11.10 oneiric Not in release
11.04 natty
Not affected
10.10 maverick
Not affected
10.04 LTS lucid
Not affected
9.10 karmic
Not affected
9.04 jaunty
Not affected
8.10 intrepid Ignored end of life, was needed
8.04 LTS hardy Ignored end of life
7.10 gutsy Ignored end of life, was needs-triage
6.06 LTS dapper Ignored end of life
libpam-krb5 11.10 oneiric
Fixed 3.11-4ubuntu1
11.04 natty
Fixed 3.11-4ubuntu1
10.10 maverick
Fixed 3.11-4ubuntu1
10.04 LTS lucid
Fixed 3.11-4ubuntu1
9.10 karmic
Fixed 3.11-4ubuntu1
9.04 jaunty
Fixed 3.11-4ubuntu1
8.10 intrepid
Fixed 3.10-1ubuntu0.8.10.1
8.04 LTS hardy
Fixed 3.10-1ubuntu0.8.04.1
7.10 gutsy Ignored end of life, was needed
6.06 LTS dapper Ignored end of life

References

Related Ubuntu Security Notices (USN)

    • USN-719-1
    • pam-krb5 vulnerabilities
    • 12 February 2009

Other references