CVE-2009-3232

NameCVE-2009-3232
Descriptionpam-auth-update for PAM, as used in Ubuntu 8.10 and 9.4, and Debian GNU/Linux, does not properly handle an "empty selection" for system authentication modules in certain rare configurations, which causes any attempt to be successful and allows remote attackers to bypass authentication.
SourceCVE (at NVD; CERT, LWN, oss-sec, fulldisc, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)
Debian Bugs519927

Vulnerable and fixed packages

The table below lists information on source packages.

Source PackageReleaseVersionStatus
pam (PTS)jessie1.1.8-3.1+deb8u2fixed
stretch1.1.8-3.6fixed
buster1.3.1-5fixed
bullseye1.4.0-9+deb11u1fixed
bookworm1.5.2-6+deb12u1fixed
sid, trixie1.5.3-7fixed

The information below is based on the following data on fixed versions.

PackageTypeReleaseFixed VersionUrgencyOriginDebian Bugs
pamsourceetch(not affected)
pamsourcelenny(not affected)
pamsource(unstable)1.0.1-10519927

Notes

[lenny] - pam <not-affected> (pam-auth-update not yet present)
[etch] - pam <not-affected> (pam-auth-update not yet present)

Search for package or bug name: Reporting problems