CVE-2009-0361: Eyrie Pam-KRB5

Medium severity, CVSS 4.6. EPSS: 0.4% chance of exploitation in the next 30 days.

Russ Allbery pam-krb5 before 3.13, as used by libpam-heimdal, su in Solaris 10, and other software, does not properly handle calls to pam_setcred when running setuid, which allows local users to overwrite and change the ownership of arbitrary files by setting the KRB5CCNAME environment variable, and then launching a setuid application that performs certain pam_setcred operations.

Affected products

• Eyrie Pam-KRB5: up to and including 3.12; version 3.0 only; version 3.1 only; version 3.2 only; version 3.3 only; version 3.4 only; …

Published 2009-02-13. Last modified 2026-06-16.