CVE-2009-1384

CVE-2009-1384 describes a username enumeration vulnerability in pam_krb5 versions 2.2.14 through 2.3.4, specifically impacting Red Hat Enterprise Linux 5. This flaw allows remote attackers to determine valid user accounts by observing differences in password prompts. The vulnerability has a CVSS score of 5.0, indicating a medium severity. It is easily exploitable over a network with low attack complexity and requires no authentication, potentially leading to information disclosure (username enumeration) without impacting integrity or availability. There is no evidence of active exploitation, nor is exploit code publicly available in Metasploit or ExploitDB. The vulnerability has received minimal community discussion and media coverage, suggesting a low level of public awareness or concern.