CVE-2009-0579

Опубликовано: 16 апр. 2009

Источник: nvd

CVSS2: 4.6

EPSS Низкий

Описание

Linux-PAM before 1.0.4 does not enforce the minimum password age (MINDAYS) as specified in /etc/shadow, which allows local users to bypass intended security policy and change their passwords sooner than specified.

Ссылки

http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=514437
http://secunia.com/advisories/34728
Vendor Advisory
http://secunia.com/advisories/34733
Vendor Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=487216
Patch
https://www.redhat.com/archives/fedora-package-announce/2009-April/msg00398.html
https://www.redhat.com/archives/fedora-package-announce/2009-April/msg00420.html
Patch
Vendor Advisory
https://www.redhat.com/archives/pam-list/2009-March/msg00006.html
Vendor Advisory
http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=514437
http://secunia.com/advisories/34728
Vendor Advisory
http://secunia.com/advisories/34733
Vendor Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=487216
Patch
https://www.redhat.com/archives/fedora-package-announce/2009-April/msg00398.html
https://www.redhat.com/archives/fedora-package-announce/2009-April/msg00420.html
Patch
Vendor Advisory
https://www.redhat.com/archives/pam-list/2009-March/msg00006.html
Vendor Advisory

Уязвимые конфигурации

Конфигурация 1

Одно из

cpe:2.3:a:linux-pam:linux-pam:*:*:*:*:*:*:*:*

Версия до 1.0.4 (включая)

cpe:2.3:a:linux-pam:linux-pam:0.99.1.0:*:*:*:*:*:*:*

cpe:2.3:a:linux-pam:linux-pam:0.99.2.0:*:*:*:*:*:*:*

cpe:2.3:a:linux-pam:linux-pam:0.99.2.1:*:*:*:*:*:*:*

cpe:2.3:a:linux-pam:linux-pam:0.99.3.0:*:*:*:*:*:*:*

cpe:2.3:a:linux-pam:linux-pam:0.99.4.0:*:*:*:*:*:*:*

cpe:2.3:a:linux-pam:linux-pam:0.99.5.0:*:*:*:*:*:*:*

cpe:2.3:a:linux-pam:linux-pam:0.99.6.0:*:*:*:*:*:*:*

cpe:2.3:a:linux-pam:linux-pam:0.99.6.1:*:*:*:*:*:*:*

cpe:2.3:a:linux-pam:linux-pam:0.99.6.2:*:*:*:*:*:*:*

cpe:2.3:a:linux-pam:linux-pam:0.99.6.3:*:*:*:*:*:*:*

cpe:2.3:a:linux-pam:linux-pam:0.99.7.0:*:*:*:*:*:*:*

cpe:2.3:a:linux-pam:linux-pam:0.99.7.1:*:*:*:*:*:*:*

cpe:2.3:a:linux-pam:linux-pam:0.99.8.0:*:*:*:*:*:*:*

cpe:2.3:a:linux-pam:linux-pam:0.99.8.1:*:*:*:*:*:*:*

cpe:2.3:a:linux-pam:linux-pam:0.99.9.0:*:*:*:*:*:*:*

cpe:2.3:a:linux-pam:linux-pam:0.99.10.0:*:*:*:*:*:*:*

cpe:2.3:a:linux-pam:linux-pam:1.0.0:*:*:*:*:*:*:*

cpe:2.3:a:linux-pam:linux-pam:1.0.1:*:*:*:*:*:*:*

cpe:2.3:a:linux-pam:linux-pam:1.0.2:*:*:*:*:*:*:*

cpe:2.3:a:linux-pam:linux-pam:1.0.3:*:*:*:*:*:*:*

EPSS

Процентиль: 19%

0.00062

Низкий

4.6 Medium

CVSS2

Дефекты

CWE-264

Связанные уязвимости

CVE-2009-0579

ubuntu

больше 16 лет назад

CVE-2009-0579

redhat

почти 17 лет назад

CVE-2009-0579

debian

больше 16 лет назад

Linux-PAM before 1.0.4 does not enforce the minimum password age (MIND ...

GHSA-hm9c-qrxw-gvc3

github

больше 3 лет назад

EPSS

Процентиль: 19%

0.00062

Низкий

4.6 Medium

CVSS2

Дефекты

CWE-264