A security issue has been reported in pam_krb5, which can be exploited by malicious people to disclose potentially sensitive information.

The security issue is caused due to pam_krb5 returning different password prompts depending on whether or not a valid user name is supplied, which can be exploited to enumerate valid user names.

The security issue is reported in versions 2.2.14 and later.

Solution
Restrict access to the pam_krb5 password prompt.

Provided and/or discovered by
Reported in a Red Hat bug report.

Original Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=502602

Deep Links
Links available to Secunia VIM customers