CVEvulnerability
CVE-2009-1384
5.0 MEDIUM
Official page ↗
- Status
- Modified
- Published
- 2009-05-28
- Last modified
- 2026-06-16
- Assigner
- [email protected]
- CVSS 2.0 ([email protected])
- 5.0 MEDIUM — AV:N/AC:L/Au:N/C:P/I:N/A:N
- Weaknesses
- CWE-287
Description
pam_krb5 2.2.14 through 2.3.4, as used in Red Hat Enterprise Linux (RHEL) 5, generates different password prompts depending on whether the user account exists, which allows remote attackers to enumerate valid usernames.
Affected configurations
• eyrie pam-krb5 2.2.14
• eyrie pam-krb5 2.3
• eyrie pam-krb5 2.3.4
Related
Weakness · CWE (1)
- CWE-287 Improper Authentication weakness
References
- http://osvdb.org/54791 osvdb.org
- http://secunia.com/advisories/35230 secunia.com
- http://secunia.com/advisories/43314 secunia.com
- http://www.mandriva.com/security/advisories?name=MDVSA-2010:054 www.mandriva.com
- http://www.openwall.com/lists/oss-security/2009/05/27/1 www.openwall.com
- http://www.securityfocus.com/archive/1/516397/100/0/threaded www.securityfocus.com
- http://www.securityfocus.com/bid/35112 www.securityfocus.com
- http://www.vmware.com/security/advisories/VMSA-2011-0003.html www.vmware.com
- http://www.vupen.com/english/advisories/2009/1448 www.vupen.com
- https://bugzilla.redhat.com/show_bug.cgi?id=502602 Vendor Advisory
- https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A7081 oval.cisecurity.org
- https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A9652 oval.cisecurity.org
- http://osvdb.org/54791 osvdb.org
- http://secunia.com/advisories/35230 secunia.com
- http://secunia.com/advisories/43314 secunia.com
- http://www.mandriva.com/security/advisories?name=MDVSA-2010:054 www.mandriva.com
- http://www.openwall.com/lists/oss-security/2009/05/27/1 www.openwall.com
- http://www.securityfocus.com/archive/1/516397/100/0/threaded www.securityfocus.com
- http://www.securityfocus.com/bid/35112 www.securityfocus.com
- http://www.vmware.com/security/advisories/VMSA-2011-0003.html www.vmware.com
- http://www.vupen.com/english/advisories/2009/1448 www.vupen.com
- https://bugzilla.redhat.com/show_bug.cgi?id=502602 Vendor Advisory
- https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A7081 oval.cisecurity.org
- https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A9652 oval.cisecurity.org