CVE-2009-1384

Published: May 28, 2009Modified: Apr 23, 2026

5.0

Vector

AV:N/AC:L/Au:N/C:P/I:N/A:N

Exploitability: 10.0 / Impact: 2.9

Source: NVD

Description

pam_krb5 2.2.14 through 2.3.4, as used in Red Hat Enterprise Linux (RHEL) 5, generates different password prompts depending on whether the user account exists, which allows remote attackers to enumerate valid usernames.

Affected (3)

Products: Eyrie: Pam Krb5

Eyrie

1 product

Pam Krb5

Configuration A

3 vulnerable · 4 platform

Vulnerable Software	Affected Versions
Eyrie Pam Krb5	Version 2.2.14
Eyrie Pam Krb5	Version 2.3.4
Eyrie Pam Krb5	Version 2.3

Running on/with	Platform Versions
Redhat Enterprise Linux	Version 5
Redhat Enterprise Linux	Version 5
Redhat Enterprise Linux	Version 5
Redhat Enterprise Linux	Version 5

Related CWEs

CWE-287

Improper Authentication

When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct.

References (24)

http://osvdb.org/54791

Source: secalert@redhat.com

http://secunia.com/advisories/35230

Source: secalert@redhat.com

http://secunia.com/advisories/43314

Source: secalert@redhat.com

http://www.mandriva.com/security/advisories?name=MDVSA-2010:054

Source: secalert@redhat.com

http://www.openwall.com/lists/oss-security/2009/05/27/1

Source: secalert@redhat.com

http://www.securityfocus.com/archive/1/516397/100/0/threaded

Source: secalert@redhat.com

http://www.securityfocus.com/bid/35112

Source: secalert@redhat.com

http://www.vmware.com/security/advisories/VMSA-2011-0003.html

Source: secalert@redhat.com

http://www.vupen.com/english/advisories/2009/1448

Source: secalert@redhat.com

https://bugzilla.redhat.com/show_bug.cgi?id=502602

Source: secalert@redhat.com

Vendor Advisory

https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A7081

Source: secalert@redhat.com

https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A9652

Source: secalert@redhat.com

http://osvdb.org/54791