libpam-krb5: multiple vulnerabilities
| Package(s): | libpam-krb5 | CVE #(s): | CVE-2009-0360 CVE-2009-0361 | ||||||||||||||||||||
| Created: | February 12, 2009 | Updated: | March 26, 2009 | ||||||||||||||||||||
| Description: | Two vulnerabilities have been found in the Kerberos PAM module.
From the Debian alert:
CVE-2009-0360 Russ Allbery discovered that the Kerberos PAM module parsed configuration settings from environment variables when run from a setuid context. This could lead to local privilege escalation if an attacker points a setuid program using PAM authentication to a Kerberos setup under her control. CVE-2009-0361 Derek Chan discovered that the Kerberos PAM module allows reinitialisation of user credentials when run from a setuid context, resulting in potential local denial of service by overwriting the credential cache file or to privilege escalation. | ||||||||||||||||||||||
| Alerts: |
| ||||||||||||||||||||||