Ubuntu Security Notice (C) 2009-2014 Canonical, Inc. / NASL script (C) 2009-2014 Tenable Network Security, Inc.
The remote Ubuntu host is missing a security-related patch.
It was discovered that pam_krb5 parsed environment variables when run
with setuid applications. A local attacker could exploit this flaw to
bypass authentication checks and gain root privileges. (CVE-2009-0360)
Derek Chan discovered that pam_krb5 incorrectly handled refreshing
existing credentials when used with setuid applications. A local
attacker could exploit this to create or overwrite arbitrary files,
and possibly gain root privileges. (CVE-2009-0361).
Update the affected libpam-krb5 package.
Risk factor :
Medium / CVSS Base Score : 6.2
CVSS Temporal Score : 5.4
Public Exploit Available : true