[ MDVSA-2010:054 ] pam_krb5

[dude67]

_______________________________________________________________________

Package : pam_krb5
Date : March 4, 2010
Affected: 2009.0, 2009.1, Enterprise Server 5.0
_______________________________________________________________________

Problem Description:

Pam_krb5 2.2.14 through 2.3.4 generates different password prompts
depending on whether the user account exists, which allows remote
attackers to enumerate valid usernames (CVE-2009-1384).

This update provides the version 2.3.5 of pam_krb5, which is not
vulnerable to this issue.
_______________________________________________________________________

References:

http://cve.mitre.org/cgi-bin/cvename.cg ... -2009-1384
_______________________________________________________________________