CVE-2009-1384: pam_krb5 2.2.14 through 2.3.4, as used in Red Hat Enterprise Linux (RHEL) 5, generates different password p...

Security readout for executives and security teams

This issue lets a remote attacker tell whether a username exists by observing different password prompts from pam_krb5. It does not directly give access, but it can improve phishing, password guessing, and targeted intrusion attempts against legacy Kerberos-backed Linux authentication. Exposure is most likely on legacy systems using vulnerable pam_krb5 for remotely reachable authentication. The supplied affected-product metadata is incomplete, but references include Red Hat, Mandriva, OVAL checks, and later VMware third-party component advisories. Treat this as a legacy exposure cleanup item, not an emergency breach signal. Prioritize externally reachable or business-critical systems, because username disclosure increases the effectiveness of credential attacks even without direct code execution. Mitigation focus: Inventory systems using pam_krb5 2.2.14 through 2.3.4.; Check Red Hat, Mandriva, VMware, or platform vendor advisories for supported updates.; Apply vendor-supported pam_krb5 or platform security updates where applicable..

Prepared

Jun 28, 2026, 10:45 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.