Executive Summary
| Informations | |||
|---|---|---|---|
| Name | MDVSA-2010:054 | First vendor Publication | 2010-03-04 |
| Vendor | Mandriva | Last vendor Modification | 2010-03-04 |
| Severity (Vendor) | N/A | Revision | N/A |
Security-Database Scoring CVSS v3
| Cvss vector : N/A | |||
|---|---|---|---|
| Overall CVSS Score | NA | ||
| Base Score | NA | Environmental Score | NA |
| impact SubScore | NA | Temporal Score | NA |
| Exploitabality Sub Score | NA | ||
| Calculate full CVSS 3.0 Vectors scores | |||
Security-Database Scoring CVSS v2
| Cvss vector : (AV:N/AC:L/Au:N/C:P/I:N/A:N) | |||
|---|---|---|---|
| Cvss Base Score | 5 | Attack Range | Network |
| Cvss Impact Score | 2.9 | Attack Complexity | Low |
| Cvss Expoit Score | 10 | Authentication | None Required |
| Calculate full CVSS 2.0 Vectors scores | |||
Detail
| Pam_krb5 2.2.14 through 2.3.4 generates different password prompts depending on whether the user account exists, which allows remote attackers to enumerate valid usernames (CVE-2009-1384). This update provides the version 2.3.5 of pam_krb5, which is not vulnerable to this issue. |
Original Source
| Url : http://www.mandriva.com/security/advisories?name=MDVSA-2010:054 |
CWE : Common Weakness Enumeration
| % | Id | Name |
|---|---|---|
| 100 % | CWE-287 | Improper Authentication |
OVAL Definitions
| Definition Id: oval:org.mitre.oval:def:19879 | |||
| Oval ID: | oval:org.mitre.oval:def:19879 | ||
| Title: | Third party component updates for VMware vCenter Server, vCenter Update Manager, ESXi and ESX | ||
| Description: | pam_krb5 2.2.14 through 2.3.4, as used in Red Hat Enterprise Linux (RHEL) 5, generates different password prompts depending on whether the user account exists, which allows remote attackers to enumerate valid usernames. | ||
| Family: | unix | Class: | vulnerability |
| Reference(s): | CVE-2009-1384 | Version: | 4 |
| Platform(s): | VMWare ESX Server 4.1 | Product(s): | |
| Definition Synopsis: | |||
| |||
| Definition Id: oval:org.mitre.oval:def:21237 | |||
| Oval ID: | oval:org.mitre.oval:def:21237 | ||
| Title: | RHSA-2010:0258: pam_krb5 security and bug fix update (Low) | ||
| Description: | pam_krb5 2.2.14 through 2.3.4, as used in Red Hat Enterprise Linux (RHEL) 5, generates different password prompts depending on whether the user account exists, which allows remote attackers to enumerate valid usernames. | ||
| Family: | unix | Class: | patch |
| Reference(s): | RHSA-2010:0258-04 CVE-2009-1384 | Version: | 4 |
| Platform(s): | Red Hat Enterprise Linux 5 | Product(s): | pam_krb5 |
| Definition Synopsis: | |||
| Definition Id: oval:org.mitre.oval:def:23055 | |||
| Oval ID: | oval:org.mitre.oval:def:23055 | ||
| Title: | ELSA-2010:0258: pam_krb5 security and bug fix update (Low) | ||
| Description: | pam_krb5 2.2.14 through 2.3.4, as used in Red Hat Enterprise Linux (RHEL) 5, generates different password prompts depending on whether the user account exists, which allows remote attackers to enumerate valid usernames. | ||
| Family: | unix | Class: | patch |
| Reference(s): | ELSA-2010:0258-04 CVE-2009-1384 | Version: | 6 |
| Platform(s): | Oracle Linux 5 | Product(s): | pam_krb5 |
| Definition Synopsis: | |||
| Definition Id: oval:org.mitre.oval:def:27558 | |||
| Oval ID: | oval:org.mitre.oval:def:27558 | ||
| Title: | DEPRECATED: ELSA-2010-0258 -- pam_krb5 security and bug fix update (low) | ||
| Description: | [2.2.14-15] - update backport for selecting which key to use for validation so that it prefers services with the local host name as the instance, from HEAD (more of #450776) [2.2.14-14] - backport the 'multiple_ccaches' option from HEAD, requiring that it be enabled to not immediately remove an old ccache when asked to create a new one (#463417) [2.2.14-13] - add patch to add the 'chpw_prompt' option, to allow the older behavior of attempting a password-change during authentication if libkrb5 detects an expired password, based on patch from Olivier Fourdan (#509092) [2.2.14-12] - dont vary the password prompt depending on whether or not the user exists or is known to the KDC (CVE-2009-1384, #505265) - prefer using the 'host' service when verifying that a TGT isnt forged, from HEAD (#450776) [2.2.14-11] - dont enforce minimum_uid when no_user_check is also used, from HEAD (#490404) - dont try to get password-changing creds with all of the flags set that we would request for a TGT (#489015) | ||
| Family: | unix | Class: | patch |
| Reference(s): | ELSA-2010-0258 CVE-2009-1384 | Version: | 4 |
| Platform(s): | Oracle Linux 5 | Product(s): | pam_krb5 |
| Definition Synopsis: | |||
| Definition Id: oval:org.mitre.oval:def:7081 | |||
| Oval ID: | oval:org.mitre.oval:def:7081 | ||
| Title: | pam_krb5 Existing/Non-Existing Username Enumeration Weakness | ||
| Description: | pam_krb5 2.2.14 through 2.3.4, as used in Red Hat Enterprise Linux (RHEL) 5, generates different password prompts depending on whether the user account exists, which allows remote attackers to enumerate valid usernames. | ||
| Family: | unix | Class: | vulnerability |
| Reference(s): | CVE-2009-1384 | Version: | 5 |
| Platform(s): | VMWare ESX Server 4.0 | Product(s): | |
| Definition Synopsis: | |||
| Definition Id: oval:org.mitre.oval:def:9652 | |||
| Oval ID: | oval:org.mitre.oval:def:9652 | ||
| Title: | pam_krb5 2.2.14 through 2.3.4, as used in Red Hat Enterprise Linux (RHEL) 5, generates different password prompts depending on whether the user account exists, which allows remote attackers to enumerate valid usernames. | ||
| Description: | pam_krb5 2.2.14 through 2.3.4, as used in Red Hat Enterprise Linux (RHEL) 5, generates different password prompts depending on whether the user account exists, which allows remote attackers to enumerate valid usernames. | ||
| Family: | unix | Class: | vulnerability |
| Reference(s): | CVE-2009-1384 | Version: | 5 |
| Platform(s): | Red Hat Enterprise Linux 5 CentOS Linux 5 Oracle Linux 5 | Product(s): | |
| Definition Synopsis: | |||
CPE : Common Platform Enumeration
| Type | Description | Count |
|---|---|---|
| Application | 3 |
OpenVAS Exploits
| Date | Description |
|---|---|
| 2012-04-16 | Name : VMSA-2010-0009: ESXi utilities and ESX Service Console third party updates File : nvt/gb_VMSA-2010-0009.nasl |
| 2012-03-16 | Name : VMSA-2011-0003.2 Third party component updates for VMware vCenter Server, vCe... File : nvt/gb_VMSA-2011-0003.nasl |
| 2010-04-06 | Name : RedHat Update for pam_krb5 RHSA-2010:0258-04 File : nvt/gb_RHSA-2010_0258-04_pam_krb5.nasl |
| 2010-03-12 | Name : Mandriva Update for pam_krb5 MDVSA-2010:054 (pam_krb5) File : nvt/gb_mandriva_MDVSA_2010_054.nasl |
| 2010-02-15 | Name : Mandriva Update for cacti MDVA-2010:054 (cacti) File : nvt/gb_mandriva_MDVA_2010_054.nasl |
| 2009-06-30 | Name : Fedora Core 11 FEDORA-2009-5983 (pam_krb5) File : nvt/fcore_2009_5983.nasl |
| 2009-06-30 | Name : Fedora Core 10 FEDORA-2009-6255 (pam_krb5) File : nvt/fcore_2009_6255.nasl |
| 2009-06-30 | Name : Fedora Core 9 FEDORA-2009-6279 (pam_krb5) File : nvt/fcore_2009_6279.nasl |
Open Source Vulnerability Database (OSVDB)
| Id | Description |
|---|---|
| 54791 | pam_krb5 Login Prompt Remote Username Enumeration |
Information Assurance Vulnerability Management (IAVM)
| Date | Description |
|---|---|
| 2011-05-12 | IAVM : 2011-A-0066 - Multiple Vulnerabilities in VMware Products Severity : Category I - VMSKEY : V0027158 |
Nessus® Vulnerability Scanner
| Date | Description |
|---|---|
| 2016-03-08 | Name : The remote VMware ESX / ESXi host is missing a security-related patch. File : vmware_VMSA-2010-0009_remote.nasl - Type : ACT_GATHER_INFO |
| 2016-03-04 | Name : The remote VMware ESX / ESXi host is missing a security-related patch. File : vmware_VMSA-2011-0003_remote.nasl - Type : ACT_GATHER_INFO |
| 2012-08-01 | Name : The remote Scientific Linux host is missing a security update. File : sl_20100330_pam_krb5_on_SL5_x.nasl - Type : ACT_GATHER_INFO |
| 2011-02-14 | Name : The remote VMware ESXi / ESX host is missing one or more security-related pat... File : vmware_VMSA-2011-0003.nasl - Type : ACT_GATHER_INFO |
| 2010-06-01 | Name : The remote VMware ESXi / ESX host is missing one or more security-related pat... File : vmware_VMSA-2010-0009.nasl - Type : ACT_GATHER_INFO |
| 2010-05-11 | Name : The remote Red Hat host is missing a security update. File : redhat-RHSA-2010-0258.nasl - Type : ACT_GATHER_INFO |
| 2010-03-05 | Name : The remote Mandriva Linux host is missing a security update. File : mandriva_MDVSA-2010-054.nasl - Type : ACT_GATHER_INFO |
| 2009-06-28 | Name : The remote Fedora host is missing a security update. File : fedora_2009-5983.nasl - Type : ACT_GATHER_INFO |
| 2009-06-28 | Name : The remote Fedora host is missing a security update. File : fedora_2009-6255.nasl - Type : ACT_GATHER_INFO |
| 2009-06-28 | Name : The remote Fedora host is missing a security update. File : fedora_2009-6279.nasl - Type : ACT_GATHER_INFO |
Alert History
| Date | Informations |
|---|---|
| 2014-02-17 11:41:18 |
|
