CVE-2009-1384

· N/AModified

← All CVEs

CVSS v3.1

N/A

EPSS

3.33%

Published

May 28, 2009

Modified

Apr 22, 2026

Public PoC / Exploit (1)

All weaponized →

TrickestTrickest PoC index

Links to public security research (Exploit-DB, Nuclei, Trickest, GitHub) for defensive use only.

Description

pam_krb5 2.2.14 through 2.3.4, as used in Red Hat Enterprise Linux (RHEL) 5, generates different password prompts depending on whether the user account exists, which allows remote attackers to enumerate valid usernames.

Weaknesses (CWE)

CWE-287

Affected Products (7)

redhat · enterprise_linux

eyrie · pam-krb5vulnerable

References (20)

http://osvdb.org/54791

http://secunia.com/advisories/35230

http://secunia.com/advisories/43314

http://www.mandriva.com/security/advisories?name=MDVSA-2010:054

http://www.openwall.com/lists/oss-security/2009/05/27/1

http://www.securityfocus.com/archive/1/516397/100/0/threaded

http://www.securityfocus.com/bid/35112

http://www.vmware.com/security/advisories/VMSA-2011-0003.html

http://www.vupen.com/english/advisories/2009/1448

https://bugzilla.redhat.com/show_bug.cgi?id=502602

Vendor Advisory

https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A7081

https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A9652