CVE-2009-3232: Canonical Ubuntu Linux

High severity, CVSS 9.3. EPSS: 4.6% chance of exploitation in the next 30 days.

pam-auth-update for PAM, as used in Ubuntu 8.10 and 9.4, and Debian GNU/Linux, does not properly handle an "empty selection" for system authentication modules in certain rare configurations, which causes any attempt to be successful and allows remote attackers to bypass authentication.

Affected products

• Canonical Ubuntu Linux: version 8.10 only; version 9.04 only

Published 2009-09-17. Last modified 2026-06-16.