CVE-2009-0360

Russ Allbery pam-krb5 before 3.13, when linked against MIT Kerberos, does not properly initialize the Kerberos libraries for setuid use, which allows local users to gain privileges by pointing an environment variable to a modified Kerberos configuration file, and then launching a PAM-based setuid application.

• CWE-287

• http://secunia.com/advisories/33914Vendor Advisory
• http://secunia.com/advisories/33917Vendor Advisory
• http://secunia.com/advisories/34260
• http://secunia.com/advisories/34449
• http://security.gentoo.org/glsa/glsa-200903-39.xml
• http://securitytracker.com/id?1021711
• http://sunsolve.sun.com/search/document.do?assetkey=1-66-252767-1
• http://support.avaya.com/elmodocs2/security/ASA-2009-070.htm
• http://www.debian.org/security/2009/dsa-1721
• http://www.eyrie.org/~eagle/software/pam-krb5/security/2009-02-11.htmlVendor Advisory
• http://www.securityfocus.com/archive/1/500892/100/0/threaded
• http://www.securityfocus.com/bid/33740
• http://www.ubuntu.com/usn/USN-719-1
• http://www.vupen.com/english/advisories/2009/0410
• http://www.vupen.com/english/advisories/2009/0426
• http://www.vupen.com/english/advisories/2009/0979
• https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A5669
• https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A5732
• http://secunia.com/advisories/33914Vendor Advisory
• http://secunia.com/advisories/33917Vendor Advisory
• http://secunia.com/advisories/34260
• http://secunia.com/advisories/34449
• http://security.gentoo.org/glsa/glsa-200903-39.xml
• http://securitytracker.com/id?1021711
• http://sunsolve.sun.com/search/document.do?assetkey=1-66-252767-1
• http://support.avaya.com/elmodocs2/security/ASA-2009-070.htm
• http://www.debian.org/security/2009/dsa-1721
• http://www.eyrie.org/~eagle/software/pam-krb5/security/2009-02-11.htmlVendor Advisory
• http://www.securityfocus.com/archive/1/500892/100/0/threaded
• http://www.securityfocus.com/bid/33740
• http://www.ubuntu.com/usn/USN-719-1
• http://www.vupen.com/english/advisories/2009/0410
• http://www.vupen.com/english/advisories/2009/0426
• http://www.vupen.com/english/advisories/2009/0979
• https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A5669
• https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A5732

Published

Feb 13, 2009

Last Modified

Jun 16, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2009-0354Cross-domain vulnerability in js/src/jsobj.cpp in Mozilla Fi…
• CVE-2009-0355components/sessionstore/src/nsSessionStore.js in Mozilla Fir…
• CVE-2009-0356Mozilla Firefox before 3.0.6 and SeaMonkey do not block link…
• CVE-2009-0357Mozilla Firefox before 3.0.6 and SeaMonkey before 1.1.15 do …
• CVE-2009-0358Mozilla Firefox 3.x before 3.0.6 does not properly implement…
• CVE-2009-0359Multiple cross-site scripting (XSS) vulnerabilities in Samiz…
• CVE-2009-0361Russ Allbery pam-krb5 before 3.13, as used by libpam-heimdal…
• CVE-2009-0362filter.d/wuftpd.conf in Fail2ban 0.8.3 uses an incorrect reg…
• CVE-2009-0363Multiple buffer overflows in (a) BarnOwl before 1.0.5 and (b…
• CVE-2009-0364Format string vulnerability in the mini_calendar component i…
• CVE-2009-0365nm-applet.conf in GNOME NetworkManager before 0.7.0.99 conta…
• CVE-2009-0366The uncompress_buffer function in src/server/simple_wml.cpp …