CVE-2009-3232

pam-auth-update for PAM, as used in Ubuntu 8.10 and 9.4, and Debian GNU/Linux, does not properly...

9.3 HighFix available

pam-auth-update for PAM, as used in Ubuntu 8.10 and 9.4, and Debian GNU/Linux, does not properly handle an "empty selection" for system authentication modules in certain rare configurations, which causes any attempt to be successful and allows remote attackers to bypass authentication.

Exploit likelihood

4.61%Up 3.3 points since Feb 4, 2022

What each source reports

NVD Score used 9.3

Record: CVE-2009-3232
CVSS 2.0: 9.3 HighAV:N/AC:M/Au:N/C:C/I:C/A:C
Weakness: CWE-287
Updated: 2026-11-02

CVE List No score

Record: CVE-2009-3232
Updated: 2026-11-02

EUVDEUVD-2009-3215 No score

Record: EUVD-2009-3215
Updated: 2026-11-03

GitHub AdvisoriesGHSA-6jvj-39c6-mh4m No score

pam-auth-update for PAM, as used in Ubuntu 8.10 and 9.4, and Debian GNU/Linux, does not properly...

Record: GHSA-6jvj-39c6-mh4m
Weakness: CWE-287
Updated: 2026-11-02

OSV No score

Record: CVE-2009-3232
Updated: 2026-11-02

OSVDEBIAN-CVE-2009-3232 No score

Record: DEBIAN-CVE-2009-3232
Updated: 2026-11-02

Affected products

canonical ubuntu linux

Affected packages

Affected packages
Package	Affected	Fixed
`pam` Debian:12	before 1.0.1-10	1.0.1-10
`pam` Debian:13	before 1.0.1-10	1.0.1-10
`pam` Debian:14	before 1.0.1-10	1.0.1-10

History

History
Recorded	Changed	Sources
Nov 3, 2026	aliases	EUVD
Nov 2, 2026	first indexed	CVE List, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2009-3232 is a high vulnerability (CVSS 9.3) in Canonical Ubuntu Linux, published September 17, 2009. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 4.61%, the 91st percentile. Fixed in pam 1.0.1-10.