VULNERABILITY INTELLIGENCE
CVE-2009-3232
CVSS score9.3 HIGH
EPSS probability4.61%
CISA KEVNot currently listed
Published2009-09-17
Last modified2026-06-16
CVSS vectorAV:N/AC:M/Au:N/C:C/I:C/A:C
Description
pam-auth-update for PAM, as used in Ubuntu 8.10 and 9.4, and Debian GNU/Linux, does not properly handle an "empty selection" for system authentication modules in certain rare configurations, which causes any attempt to be successful and allows remote attackers to bypass authentication.
Weakness classification
- CWE-287: Improper Authentication
Primary references
- cve@mitre.org — Issue Tracking, Mailing List
- cve@mitre.org — Broken Link, Vendor Advisory
- cve@mitre.org — Mailing List
- cve@mitre.org — Broken Link, Patch, Third Party Advisory, VDB Entry
- cve@mitre.org — Issue Tracking, Patch
- cve@mitre.org — Broken Link
- af854a3a-2127-422b-91ae-364da2661108 — Issue Tracking, Mailing List
- af854a3a-2127-422b-91ae-364da2661108 — Broken Link, Vendor Advisory
- af854a3a-2127-422b-91ae-364da2661108 — Mailing List
- af854a3a-2127-422b-91ae-364da2661108 — Broken Link, Patch, Third Party Advisory, VDB Entry
- af854a3a-2127-422b-91ae-364da2661108 — Issue Tracking, Patch
- af854a3a-2127-422b-91ae-364da2661108 — Broken Link