Description
Russ Allbery pam-krb5 before 3.13, when linked against MIT Kerberos, does not properly initialize the Kerberos libraries for setuid use, which allows local users to gain privileges by pointing an environment variable to a modified Kerberos configuration file, and then launching a PAM-based setuid application.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | libpam-krb5 | 3.13-2 | — |
| Debian 13 | libpam-krb5 | 3.13-2 | — |
| Debian 12 | libpam-krb5 | 3.13-2 | — |
| Debian 4.0 | libpam-krb5 | 2.6-1etch1 | DSA-1721-1 |
Public exploits
Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.
Exploit-DB 1
- pam-krb5 < 3.13 - Local Privilege Escalation EDB-8303 · local · Mar 29, 2009 · verified
Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.
Advisories 1
- DSA-1721-1 libpam-krb5 - local privilege Debian Security (DSA / DLA) · Mar 9, 2026
References
- 34260 third-party-advisory
- 252767 vendor-advisory
- oval:org.mitre.oval:def:5732 vdb-entry signature
- 33914 third-party-advisory
- USN-719-1 vendor-advisory
- ADV-2009-0426 vdb-entry
- 1021711 vdb-entry
- ADV-2009-0410 vdb-entry
- http://support.avaya.com/elmodocs2/security/ASA-2009-070.htm
- 34449 third-party-advisory
- 33917 third-party-advisory
- DSA-1721 vendor-advisory
- 20090211 pam-krb5 security advisory (3.12 and earlier) mailing-list
- http://www.eyrie.org/~eagle/software/pam-krb5/security/2009-02-11.html
- GLSA-200903-39 vendor-advisory
- oval:org.mitre.oval:def:5669 vdb-entry signature
- 33740 vdb-entry
- ADV-2009-0979 vdb-entry