CVE Feed

    Dashboard / CVE / CVE-2009-1384

    CVE-2009-1384

    pam_krb5 2.2.14 through 2.3.4, as used in Red Hat Enterprise Linux (RHEL) 5, generates different password prompts depending on whether the user account exists, which allows remote attackers to enumerate valid usernames.

    Published:May 27, 2009
    Last Modified:Apr 23, 2026
    EPS:May 28, 2009
    EPSS Score:0.01775
    CVSS Score:5

    Affected Products

    Vendor
    Eyrie
    Product
    Pam-krb5
    Vendor
    Redhat
    Product
    Enterprise Linux

    Exploits

    No exploit reference

    Common Weakness Enumeration

    CWE-287 Improper Authentication

    References

    http://osvdb.org/54791
    http://secunia.com/advisories/35230
    http://secunia.com/advisories/43314
    http://www.mandriva.com/security/advisories?name=MDVSA-2010:054
    http://www.openwall.com/lists/oss-security/2009/05/27/1
    http://www.securityfocus.com/archive/1/516397/100/0/threaded
    http://www.securityfocus.com/bid/35112
    http://www.vmware.com/security/advisories/VMSA-2011-0003.html
    http://www.vupen.com/english/advisories/2009/1448
    https://bugzilla.redhat.com/show_bug.cgi?id=502602
    https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A7081
    https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A9652
    http://osvdb.org/54791
    http://secunia.com/advisories/35230
    http://secunia.com/advisories/43314
    http://www.mandriva.com/security/advisories?name=MDVSA-2010:054
    http://www.openwall.com/lists/oss-security/2009/05/27/1
    http://www.securityfocus.com/archive/1/516397/100/0/threaded
    http://www.securityfocus.com/bid/35112
    http://www.vmware.com/security/advisories/VMSA-2011-0003.html
    http://www.vupen.com/english/advisories/2009/1448
    https://bugzilla.redhat.com/show_bug.cgi?id=502602
    https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A7081
    https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A9652

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High