CVE-2009-0360 Privilege escalation in n/a
Local attackers can gain privileges by manipulating environment variables to load a modified Kerberos configuration in setuid applications.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2009-0360?
CVE-2009-0360 is a medium-severity vulnerability in n/a, published on 13 Feb 2009. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
Russ Allbery pam-krb5 before 3.13, when linked against MIT Kerberos, does not properly initialize the Kerberos libraries for setuid use, which allows local users to gain privileges by pointing an environment variable to a modified Kerberos configuration file, and then launching a PAM-based setuid application.
Weakness: CWE-287
Which versions are affected by CVE-2009-0360?
It affects 1 product.
Products include Eyrie Pam-Krb5.
How do I fix CVE-2009-0360?
Upgrade to a fixed version.
Is CVE-2009-0360 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2009-0360 exists.
Public exploit code: 1 Exploit-DB entry.
Other vulnerabilities in n/a
Sources
Also known as DEBIAN-CVE-2009-0360, GHSA-56h7-99r3-xgmr.