CVE-2009-0360

Exp

Russ Allbery pam-krb5 before 3.13, when linked against MIT Kerberos, does not properly initialize the Kerberos libraries for setuid use, which allows local users to gain privileges by pointing an environment variable to a modified Kerberos configuration file, and then launching a PAM-based setuid application.

Published: 2009-02-13 Last update: 2026-04-23 Assigner: [email protected] Source: [email protected]

Conclusion & alert: CVE-2009-0360 is rated Exploit Available (56.7/100): CVSS Medium severity, with low exploitation likelihood (EPSS 0.25%). Core evidence: 1 public exploit reference(s) are indexed (Exploit-DB). Mandatory action: Public exploits are available—assess exposure, apply mitigations, and prioritize patching.

Risk is dynamic; we continuously reassess and refresh what is shown on this page as upstream context changes.

Public exploit references (Exploit-DB) for CVE-2009-0360

EDB-ID Source Kind Published Link
8303 exploit_db edb 2009-03-29 Exploit-DB ↗

Exploit prediction scoring system (EPSS) score for CVE-2009-0360

EPSS lead: Daily EPSS estimates relative likelihood of exploitation; percentile ranks this CVE among scored vulnerabilities (higher = more severe relative rank).

# Date Old EPSS score New EPSS score Delta (New - Old)
1 2026-04-05 0.23% 0.25% +0.02%
2 2026-02-13 0.25% 0.23% -0.02%
3 2026-01-29 0.25%

Full EPSS history (8 records total)

Common vulnerability scoring system (CVSS) metrics for CVE-2009-0360

CVSS metrics for this CVE.

Base score Version Severity Vector Exploitability Impact Score source
6.2 2.0 MEDIUM
AV:L/AC:H/Au:N/C:C/I:C/A:C Click to expand
Access vector (AV:L)
Requires local access to the target system.
Access complexity (AC:H)
Exploitation requires uncommon or highly specific conditions.
Authentication (AU:N)
No authentication is required.
Confidentiality impact (C:C)
Complete confidentiality impact.
Integrity impact (I:C)
Complete integrity impact.
Availability impact (A:C)
Complete availability impact.
1.9 10.0 [email protected]

Weakness enumeration for CVE-2009-0360

OS Trackers for CVE-2009-0360

vendor priority summary link
debian not yet assigned CVE-2009-0360 not yet assigned priority: Debian including 1 source packages (libpam-krb5), 5 status rows across 5 suites (bookworm, bullseye, forky, sid, trixie): resolved 5. https://security-tracker.debian.org/tracker/CVE-2009-0360
gentoo high CVE-2009-0360: 2 GLSA(s) (200903-39, 201412-08), 27 atom(s) (app-antivirus/bitdefender-console, app-arch/gzip, …); latest impact high. https://bugs.gentoo.org/buglist.cgi?quicksearch=CVE-2009-0360
redhat https://access.redhat.com/security/cve/CVE-2009-0360
ubuntu medium CVE-2009-0360 medium priority: Ubuntu including 1 source packages (libpam-krb5), 7 status rows across 7 suites (dapper, gutsy, hardy, intrepid, jaunty, karmic, upstream): released 5, ignored 2. https://ubuntu.com/security/CVE-2009-0360

NVD evaluator notes for CVE-2009-0360

Comment: Per vendor advisory: http://www.eyrie.org/~eagle/software/pam-krb5/security/2009-02-11.html "This advisory is only for my pam-krb5 module, as distributed from my web site and packaged by Debian, Ubuntu, and Gentoo."

Vendor comments (NVD) for CVE-2009-0360

  • Red Hat (2009-02-13T00:00:00)

    Not vulnerable. This issue did not affect the versions of the pam_krb5 package, as shipped with Red Hat Enterprise Linux 2.1, 3, 4, or 5.

Affected software / configurations for CVE-2009-0360

Vendor Product Version Raw CPE
eyrie pam-krb5 <= 3.12 cpe:2.3:a:eyrie:pam-krb5:*:*:*:*:*:*:*:*
eyrie pam-krb5 2.0 cpe:2.3:a:eyrie:pam-krb5:2.0:*:*:*:*:*:*:*
eyrie pam-krb5 2.1 cpe:2.3:a:eyrie:pam-krb5:2.1:*:*:*:*:*:*:*
eyrie pam-krb5 2.2 cpe:2.3:a:eyrie:pam-krb5:2.2:*:*:*:*:*:*:*
eyrie pam-krb5 2.3 cpe:2.3:a:eyrie:pam-krb5:2.3:*:*:*:*:*:*:*
eyrie pam-krb5 2.4 cpe:2.3:a:eyrie:pam-krb5:2.4:*:*:*:*:*:*:*
eyrie pam-krb5 2.5 cpe:2.3:a:eyrie:pam-krb5:2.5:*:*:*:*:*:*:*
eyrie pam-krb5 2.6 cpe:2.3:a:eyrie:pam-krb5:2.6:*:*:*:*:*:*:*
eyrie pam-krb5 3.0 cpe:2.3:a:eyrie:pam-krb5:3.0:*:*:*:*:*:*:*
eyrie pam-krb5 3.1 cpe:2.3:a:eyrie:pam-krb5:3.1:*:*:*:*:*:*:*
eyrie pam-krb5 3.2 cpe:2.3:a:eyrie:pam-krb5:3.2:*:*:*:*:*:*:*
eyrie pam-krb5 3.3 cpe:2.3:a:eyrie:pam-krb5:3.3:*:*:*:*:*:*:*
eyrie pam-krb5 3.4 cpe:2.3:a:eyrie:pam-krb5:3.4:*:*:*:*:*:*:*
eyrie pam-krb5 3.5 cpe:2.3:a:eyrie:pam-krb5:3.5:*:*:*:*:*:*:*
eyrie pam-krb5 3.6 cpe:2.3:a:eyrie:pam-krb5:3.6:*:*:*:*:*:*:*
eyrie pam-krb5 3.7 cpe:2.3:a:eyrie:pam-krb5:3.7:*:*:*:*:*:*:*
eyrie pam-krb5 3.8 cpe:2.3:a:eyrie:pam-krb5:3.8:*:*:*:*:*:*:*
eyrie pam-krb5 3.9 cpe:2.3:a:eyrie:pam-krb5:3.9:*:*:*:*:*:*:*
eyrie pam-krb5 3.10 cpe:2.3:a:eyrie:pam-krb5:3.10:*:*:*:*:*:*:*
eyrie pam-krb5 3.11 cpe:2.3:a:eyrie:pam-krb5:3.11:*:*:*:*:*:*:*

References for CVE-2009-0360

URL Tags
http://secunia.com/advisories/33914 Vendor Advisory
http://secunia.com/advisories/33917 Vendor Advisory
http://secunia.com/advisories/34260
http://secunia.com/advisories/34449
http://security.gentoo.org/glsa/glsa-200903-39.xml
http://securitytracker.com/id?1021711
http://sunsolve.sun.com/search/document.do?assetkey=1-66-252767-1
http://support.avaya.com/elmodocs2/security/ASA-2009-070.htm
http://www.debian.org/security/2009/dsa-1721
http://www.eyrie.org/~eagle/software/pam-krb5/security/2009-02-11.html Vendor Advisory
http://www.securityfocus.com/archive/1/500892/100/0/threaded
http://www.securityfocus.com/bid/33740
http://www.ubuntu.com/usn/USN-719-1
http://www.vupen.com/english/advisories/2009/0410
http://www.vupen.com/english/advisories/2009/0426
http://www.vupen.com/english/advisories/2009/0979
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A5669
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A5732
cvelogic Threat Intelligence