CVEvulnerability
CVE-2009-3232
9.3 HIGH
Official page ↗
- Status
- Modified
- Published
- 2009-09-17
- Last modified
- 2026-06-16
- Assigner
- [email protected]
- CVSS 2.0 ([email protected])
- 9.3 HIGH — AV:N/AC:M/Au:N/C:C/I:C/A:C
- Weaknesses
- CWE-287
Description
pam-auth-update for PAM, as used in Ubuntu 8.10 and 9.4, and Debian GNU/Linux, does not properly handle an "empty selection" for system authentication modules in certain rare configurations, which causes any attempt to be successful and allows remote attackers to bypass authentication.
Affected configurations
• canonical ubuntu linux 8.10
• canonical ubuntu linux 9.04
Related
Weakness · CWE (1)
- CWE-287 Improper Authentication weakness
Referenced by CWE · observed example (1)
- CWE-287 Improper Authentication weakness
References
- http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=519927 Issue Tracking, Mailing List
- http://secunia.com/advisories/36620 Broken Link, Vendor Advisory
- http://www.openwall.com/lists/oss-security/2009/09/08/7 Mailing List
- http://www.securityfocus.com/bid/36306 Broken Link, Patch, Third Party Advisory, VDB Entry
- https://launchpad.net/bugs/410171 Issue Tracking, Patch
- https://usn.ubuntu.com/828-1/ Broken Link
- http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=519927 Issue Tracking, Mailing List
- http://secunia.com/advisories/36620 Broken Link, Vendor Advisory
- http://www.openwall.com/lists/oss-security/2009/09/08/7 Mailing List
- http://www.securityfocus.com/bid/36306 Broken Link, Patch, Third Party Advisory, VDB Entry
- https://launchpad.net/bugs/410171 Issue Tracking, Patch
- https://usn.ubuntu.com/828-1/ Broken Link