CVE-2009-0360: Russ Allbery pam-krb5 before 3.13, when linked against MIT Kerberos, does not properly initialize the Kerbe...

Security readout for executives and security teams

This is a local privilege-escalation issue in pam-krb5 before 3.13 when built with MIT Kerberos. A person who already has local access could abuse Kerberos configuration handling through a PAM-based setuid program to gain higher privileges. It is not described as remotely exploitable. Exposure is most likely on Unix-like systems using Russ Allbery pam-krb5 versions before 3.13, linked against MIT Kerberos, with PAM-based setuid applications available to local users. Systems not using pam-krb5, not using the affected build path, or already updated through vendor packages are less likely exposed. Prioritize remediation on shared servers, authentication infrastructure, and multi-user systems. The issue needs local access, but privilege escalation can turn a low-privileged account into a broader system compromise path. Mitigation focus: Upgrade pam-krb5 to version 3.13 or later where applicable.; Apply the relevant vendor security updates for affected distributions or appliances.; Check vendor advisories before changing Kerberos or PAM behavior..

Prepared

Jun 28, 2026, 11:23 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.