CVE-2009-3232
pam-auth-update for PAM, as used in Ubuntu 8.10 and 9.4, and Debian GNU/Linux, does not properly...
CVE-2009-3232 is a high vulnerability (CVSS 9.3) in Canonical Ubuntu Linux, published September 17, 2009. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 4.61%, the 91st percentile. Fixed in pam 1.0.1-10.
- Severity
- 9.3 HighCVSS 2.0, NVD
- Exploit chance
- 4.61%EPSS, 91st percentile
- Exploitation
- None knownNot on CISA’s or ENISA’s lists
- Fixed in
1.0.1-10pam +2 more
Description
pam-auth-update for PAM, as used in Ubuntu 8.10 and 9.4, and Debian GNU/Linux, does not properly handle an "empty selection" for system authentication modules in certain rare configurations, which causes any attempt to be successful and allows remote attackers to bypass authentication.
Exploit likelihood
Affected products
Affected packages
What each source reports
NVD Score used
pam-auth-update for PAM, as used in Ubuntu 8.10 and 9.4, and Debian GNU/Linux, does not properly handle an "empty selection" for system authentication modules in certain rare configurations, which causes any attempt to be successful and allows remote attackers to bypass authentication.
- Record
CVE-2009-3232- CVSS 2.0
- 9.3 High
AV:N/AC:M/Au:N/C:C/I:C/A:C - Weakness
- CWE-287
- Updated
- 2026-11-02
CVE ListNo score
pam-auth-update for PAM, as used in Ubuntu 8.10 and 9.4, and Debian GNU/Linux, does not properly handle an "empty selection" for system authentication modules in certain rare configurations, which causes any attempt to be successful and allows remote attackers to bypass authentication.
- Record
CVE-2009-3232- Updated
- 2026-11-02
EUVDEUVD-2009-3215No score
pam-auth-update for PAM, as used in Ubuntu 8.10 and 9.4, and Debian GNU/Linux, does not properly handle an "empty selection" for system authentication modules in certain rare configurations, which causes any attempt to be successful and allows remote attackers to bypass authentication.
- Record
EUVD-2009-3215- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-6jvj-39c6-mh4mNo score
pam-auth-update for PAM, as used in Ubuntu 8.10 and 9.4, and Debian GNU/Linux, does not properly...
pam-auth-update for PAM, as used in Ubuntu 8.10 and 9.4, and Debian GNU/Linux, does not properly handle an "empty selection" for system authentication modules in certain rare configurations, which causes any attempt to be successful and allows remote attackers to bypass authentication.
- Record
GHSA-6jvj-39c6-mh4m- Weakness
- CWE-287
- Updated
- 2026-11-02
OSVNo score
pam-auth-update for PAM, as used in Ubuntu 8.10 and 9.4, and Debian GNU/Linux, does not properly handle an "empty selection" for system authentication modules in certain rare configurations, which causes any attempt to be successful and allows remote attackers to bypass authentication.
- Record
CVE-2009-3232- Updated
- 2026-11-02
OSVDEBIAN-CVE-2009-3232No score
pam-auth-update for PAM, as used in Ubuntu 8.10 and 9.4, and Debian GNU/Linux, does not properly handle an "empty selection" for system authentication modules in certain rare configurations, which causes any attempt to be successful and allows remote attackers to bypass authentication.
- Record
DEBIAN-CVE-2009-3232- Updated
- 2026-11-02
History
| Recorded | Changed | Sources |
|---|---|---|
| facts | ||
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
References
bugs.debian.org/cgi-bin/bugreport.cgi?bug=519927
launchpad.net/bugs/410171
secunia.com/advisories/36620
openwall.com/lists/oss-security/2009/09/08/7
securityfocus.com/bid/36306
usn.ubuntu.com/828-1
nvd.nist.gov/vuln/detail/CVE-2009-3232
github.com/advisories/GHSA-6jvj-39c6-mh4m
security-tracker.debian.org/tracker/CVE-2009-3232