CVE-2009-3232

CriticalCVSS 9.3/10Last modified Jun 16, 2026

Description

pam-auth-update for PAM, as used in Ubuntu 8.10 and 9.4, and Debian GNU/Linux, does not properly handle an "empty selection" for system authentication modules in certain rare configurations, which causes any attempt to be successful and allows remote attackers to bypass authentication.

Metrics

CVSS 2.0 9.3/10AV:N/AC:M/Au:N/C:C/I:C/A:C

Weakness enumeration

CWE-287

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=519927Issue Tracking, Mailing List
http://secunia.com/advisories/36620Broken Link, Vendor Advisory
http://www.openwall.com/lists/oss-security/2009/09/08/7Mailing List
http://www.securityfocus.com/bid/36306Broken Link, Patch, Third Party Advisory, VDB Entry
https://launchpad.net/bugs/410171Issue Tracking, Patch
https://usn.ubuntu.com/828-1/Broken Link
http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=519927Issue Tracking, Mailing List
http://secunia.com/advisories/36620Broken Link, Vendor Advisory
http://www.openwall.com/lists/oss-security/2009/09/08/7Mailing List
http://www.securityfocus.com/bid/36306Broken Link, Patch, Third Party Advisory, VDB Entry
https://launchpad.net/bugs/410171Issue Tracking, Patch
https://usn.ubuntu.com/828-1/Broken Link

Timeline

Published: Sep 17, 2009
Last modified: Jun 16, 2026
NVD status: Modified

Related CVEs from 2009

CVE-2009-32337.2changetrack 4.3 allows local users to execute arbitrary commands via CRLF sequences and shell metacharacters in a filename in a directory th CVE-2009-32344.9Buffer overflow in the perf_copy_attr function in kernel/perf_counter.c in the Linux kernel 2.6.31-rc1 allows local users to cause a denial CVE-2009-32357.5Multiple stack-based buffer overflows in the Sieve plugin in Dovecot 1.0 before 1.0.4 and 1.1 before 1.1.7, as derived from Cyrus libsieve, CVE-2009-32364.3The form library in Horde Application Framework 3.2 before 3.2.5 and 3.3 before 3.3.5; Groupware 1.1 before 1.1.6 and 1.2 before 1.2.4; and CVE-2009-32374.3Multiple cross-site scripting (XSS) vulnerabilities in Horde Application Framework 3.2 before 3.2.5 and 3.3 before 3.3.5; Groupware 1.1 befo CVE-2009-32385.5The get_random_int function in drivers/char/random.c in the Linux kernel before 2.6.30 produces insufficiently random numbers, which allows CVE-2009-32404.3Cross-site scripting (XSS) vulnerability in the Happy Linux XF-Section module 1.12a for XOOPS allows remote attackers to inject arbitrary we CVE-2009-32417.8Unspecified vulnerability in the OpcUa (OPC UA) dissector in Wireshark 0.99.6 through 1.0.8 and 1.2.0 through 1.2.1 allows remote attackers CVE-2009-32425.0Unspecified vulnerability in packet.c in the GSM A RR dissector in Wireshark 1.2.0 and 1.2.1 allows remote attackers to cause a denial of se CVE-2009-32435.0Unspecified vulnerability in the TLS dissector in Wireshark 1.2.0 and 1.2.1, when running on Windows, allows remote attackers to cause a den CVE-2009-32449.3Heap-based buffer overflow in the SwDir.dll ActiveX control in Adobe Shockwave Player 11.5.1.601 and earlier allows remote attackers to caus CVE-2009-324510.0OpenSSL before 0.9.8m does not check for a NULL return value from bn_wexpand function calls in (1) crypto/bn/bn_div.c, (2) crypto/bn/bn_gf2m