Description
pam_krb5 2.2.14 through 2.3.4, as used in Red Hat Enterprise Linux (RHEL) 5, generates different password prompts depending on whether the user account exists, which allows remote attackers to enumerate valid usernames.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 5 | pam_krb5 | 2.2.14-15 | RHSA-2010:0258 |
Advisories 1
- RHSA-2010:0258 Red Hat Security Advisory: pam_krb5 security and bug fix update Red Hat Security Advisories (RHSA) · Jun 26, 2026
References
- 35230 third-party-advisory
- oval:org.mitre.oval:def:9652 vdb-entry signature
- https://bugzilla.redhat.com/show_bug.cgi?id=502602
- 43314 third-party-advisory
- [oss-security] 20090527 CVE assignment notification (pam_krb5 CVE-2009-1384) mailing-list
- oval:org.mitre.oval:def:7081 vdb-entry signature
- MDVSA-2010:054 vendor-advisory
- 54791 vdb-entry
- http://www.vmware.com/security/advisories/VMSA-2011-0003.html
- 20110211 VMSA-2011-0003 Third party component updates for VMware vCenter Server, vCenter Update Manager, ESXi and ESX mailing-list
- ADV-2009-1448 vdb-entry
- 35112 vdb-entry