CVE-2009-1384

N/A Unknown

Published: May 28, 2009 Modified: April 23, 2026

Description

pam_krb5 2.2.14 through 2.3.4, as used in Red Hat Enterprise Linux (RHEL) 5, generates different password prompts depending on whether the user account exists, which allows remote attackers to enumerate valid usernames.

AI Explanation

Get an AI-powered plain-language explanation of this vulnerability and remediation steps.

References to Advisories, Solutions, and Tools

Patch Vendor Advisory Exploit Third Party Advisory

http://osvdb.org/54791

Source: secalert@redhat.com

http://secunia.com/advisories/35230

Source: secalert@redhat.com

http://secunia.com/advisories/43314

Source: secalert@redhat.com

http://www.mandriva.com/security/advisories?name=MDVSA-2010:054

Source: secalert@redhat.com

http://www.openwall.com/lists/oss-security/2009/05/27/1

Source: secalert@redhat.com

http://www.securityfocus.com/archive/1/516397/100/0/threaded

Source: secalert@redhat.com

http://www.securityfocus.com/bid/35112

Source: secalert@redhat.com

http://www.vmware.com/security/advisories/VMSA-2011-0003.html

Source: secalert@redhat.com

http://www.vupen.com/english/advisories/2009/1448

Source: secalert@redhat.com

https://bugzilla.redhat.com/show_bug.cgi?id=502602

Source: secalert@redhat.com

Vendor Advisory

https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A7081

Source: secalert@redhat.com

https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A9652

Source: secalert@redhat.com

http://osvdb.org/54791