CVEvulnerability
CVE-2008-3825
4.4 MEDIUM
Official page ↗
- Status
- Modified
- Published
- 2008-10-03
- Last modified
- 2026-06-16
- Assigner
- [email protected]
- CVSS 2.0 ([email protected])
- 4.4 MEDIUM — AV:L/AC:M/Au:N/C:P/I:P/A:P
- Weaknesses
- CWE-264
Description
pam_krb5 2.2.14 in Red Hat Enterprise Linux (RHEL) 5 and earlier, when the existing_ticket option is enabled, uses incorrect privileges when reading a Kerberos credential cache, which allows local users to gain privileges by setting the KRB5CCNAME environment variable to an arbitrary cache filename and running the (1) su or (2) sudo program. NOTE: there may be a related vector involving sshd that has limited relevance.
Affected configurations
• redhat enterprise linux 5
• redhat enterprise linux desktop 5
Related
Weakness · not in database (1)
References
- http://lists.opensuse.org/opensuse-security-announce/2008-12/msg00002.html lists.opensuse.org
- http://secunia.com/advisories/32119 secunia.com
- http://secunia.com/advisories/32135 secunia.com
- http://secunia.com/advisories/32174 secunia.com
- http://secunia.com/advisories/43314 secunia.com
- http://www.mandriva.com/security/advisories?name=MDVSA-2008:209 www.mandriva.com
- http://www.redhat.com/support/errata/RHSA-2008-0907.html www.redhat.com
- http://www.securityfocus.com/archive/1/516397/100/0/threaded www.securityfocus.com
- http://www.securityfocus.com/bid/31534 www.securityfocus.com
- http://www.securitytracker.com/id?1020978 www.securitytracker.com
- http://www.vmware.com/security/advisories/VMSA-2011-0003.html www.vmware.com
- https://bugzilla.redhat.com/show_bug.cgi?id=461960 bugzilla.redhat.com
- https://exchange.xforce.ibmcloud.com/vulnerabilities/45635 exchange.xforce.ibmcloud.com
- https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10923 oval.cisecurity.org
- https://www.redhat.com/archives/fedora-package-announce/2008-October/msg00150.html www.redhat.com
- https://www.redhat.com/archives/fedora-package-announce/2008-October/msg00166.html www.redhat.com
- http://lists.opensuse.org/opensuse-security-announce/2008-12/msg00002.html lists.opensuse.org
- http://secunia.com/advisories/32119 secunia.com
- http://secunia.com/advisories/32135 secunia.com
- http://secunia.com/advisories/32174 secunia.com
- http://secunia.com/advisories/43314 secunia.com
- http://www.mandriva.com/security/advisories?name=MDVSA-2008:209 www.mandriva.com
- http://www.redhat.com/support/errata/RHSA-2008-0907.html www.redhat.com
- http://www.securityfocus.com/archive/1/516397/100/0/threaded www.securityfocus.com
- http://www.securityfocus.com/bid/31534 www.securityfocus.com
- http://www.securitytracker.com/id?1020978 www.securitytracker.com
- http://www.vmware.com/security/advisories/VMSA-2011-0003.html www.vmware.com
- https://bugzilla.redhat.com/show_bug.cgi?id=461960 bugzilla.redhat.com
- https://exchange.xforce.ibmcloud.com/vulnerabilities/45635 exchange.xforce.ibmcloud.com
- https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10923 oval.cisecurity.org
- https://www.redhat.com/archives/fedora-package-announce/2008-October/msg00150.html www.redhat.com
- https://www.redhat.com/archives/fedora-package-announce/2008-October/msg00166.html www.redhat.com