« Back to list

CVE-2009-2482

Status: ModifiedMedium (6.9)—

The pam_unix module in OpenPAM in NetBSD 4.0 before 4.0.2 and 5.0 before 5.0.1 allows local users to change the current root password if it is already known, even when they are not in the wheel group.

CVSS

Exploitation probability (EPSS)

EPSS (Exploit Prediction Scoring System, FIRST) estimates how likely a vulnerability is to be exploited in the wild within 30 days. It complements CVSS (impact) and CISA KEV (confirmed exploitation).

Affected technologies (1)

Netbsd — Netbsd

CWEs

References

Raw JSON (NVD)

Show
{
  "id": "CVE-2009-2482",
  "cveTags": [],
  "metrics": {
    "cvssMetricV2": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "version": "2.0",
          "baseScore": 6.9,
          "accessVector": "LOCAL",
          "vectorString": "AV:L/AC:M/Au:N/C:C/I:C/A:C",
          "authentication": "NONE",
          "integrityImpact": "COMPLETE",
          "accessComplexity": "MEDIUM",
          "availabilityImpact": "COMPLETE",
          "confidentialityImpact": "COMPLETE"
        },
        "acInsufInfo": false,
        "impactScore": 10,
        "baseSeverity": "MEDIUM",
        "obtainAllPrivilege": false,
        "exploitabilityScore": 3.4,
        "obtainUserPrivilege": false,
        "obtainOtherPrivilege": false,
        "userInteractionRequired": false
      }
    ]
  },
  "affected": [
    {
      "source": "cve@mitre.org",
      "affectedData": [
        {
          "vendor": "n/a",
          "product": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ]
    }
  ],
  "published": "2009-07-16T16:30:00.453",
  "references": [
    {
      "url": "ftp://ftp.netbsd.org/pub/NetBSD/security/advisories/NetBSD-SA2009-004.txt.asc",
      "source": "cve@mitre.org"
    },
    {
      "url": "http://osvdb.org/55284",
      "source": "cve@mitre.org"
    },
    {
      "url": "http://secunia.com/advisories/35553",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "cve@mitre.org"
    },
    {
      "url": "http://www.securityfocus.com/bid/35465",
      "source": "cve@mitre.org"
    },
    {
      "url": "http://www.securitytracker.com/id?1022432",
      "source": "cve@mitre.org"
    },
    {
      "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/51312",
      "source": "cve@mitre.org"
    },
    {
      "url": "ftp://ftp.netbsd.org/pub/NetBSD/security/advisories/NetBSD-SA2009-004.txt.asc",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://osvdb.org/55284",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://secunia.com/advisories/35553",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://www.securityfocus.com/bid/35465",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://www.securitytracker.com/id?1022432",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/51312",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "CWE-264"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "The pam_unix module in OpenPAM in NetBSD 4.0 before 4.0.2 and 5.0 before 5.0.1 allows local users to change the current root password if it is already known, even when they are not in the wheel group."
    },
    {
      "lang": "es",
      "value": "El módulo pam_unix en OpenPAM en NetBSD v4.0 anteriores a v4.0.2 y v5.0 anteriores a v5.0.1 permite a los usuarios locales cambiar la contraseña de administrador actual si ya se conoce, aún cuando no están en el grupo \"wheel \"."
    }
  ],
  "lastModified": "2026-06-16T23:09:32.787",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:netbsd:netbsd:4.0:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "9875E709-11BA-4B8F-A2FC-26844DD4D563"
            },
            {
              "criteria": "cpe:2.3:o:netbsd:netbsd:4.0:beta:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "FCB9E9F8-7C6B-4BC7-A593-A11B9D6F0B35"
            },
            {
              "criteria": "cpe:2.3:o:netbsd:netbsd:4.0:beta2:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "2F4B6E29-B74F-45FF-AEB1-A118753F8E3C"
            },
            {
              "criteria": "cpe:2.3:o:netbsd:netbsd:4.0.1:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "49AF042F-5047-4FA2-B20C-65B2C6EBEA5C"
            },
            {
              "criteria": "cpe:2.3:o:netbsd:netbsd:4.1:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "6BE00F7F-0A3A-4ECA-9FB6-1DE37C2ED5A1"
            },
            {
              "criteria": "cpe:2.3:o:netbsd:netbsd:5.0:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "00564BAA-066A-4627-B6A8-78724E55D363"
            },
            {
              "criteria": "cpe:2.3:o:netbsd:netbsd:5.0:rc3:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "38C0F962-B1C5-4F4B-A7C2-AB8C3EDC996D"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "cve@mitre.org"
}