diff --git a/pam_krb5-2.2.3-1-setcred-assume-establish.dif b/pam_krb5-2.2.3-1-setcred-assume-establish.dif
new file mode 100644
index 0000000..36fbccd
--- /dev/null
+++ b/pam_krb5-2.2.3-1-setcred-assume-establish.dif
@@ -0,0 +1,11 @@
+--- src/auth.c
++++ src/auth.c	2009/01/29 11:44:07
+@@ -419,6 +419,6 @@
+ 	if (flags & PAM_DELETE_CRED) {
+ 		return pam_sm_close_session(pamh, flags, argc, argv);
+ 	}
+-	warn("pam_setcred() called with no flags");
+-	return PAM_SERVICE_ERR;
++	warn("pam_setcred() called with no flags. Assume PAM_ESTABLISH_CRED");
++	return pam_sm_open_session(pamh, (flags | PAM_ESTABLISH_CRED), argc, argv);
+ }
diff --git a/pam_krb5.changes b/pam_krb5.changes
index d6b3af1..e091979 100644
--- a/pam_krb5.changes
+++ b/pam_krb5.changes
@@ -1,3 +1,9 @@
+-------------------------------------------------------------------
+Mon Feb  2 17:30:42 CET 2009 - mc@suse.de
+
+- pam_sm_setcred should assume PAM_ESTABLISH_CRED
+  if no flag are passed (bnc#470414)
+
 -------------------------------------------------------------------
 Tue Jan 13 12:34:56 CET 2009 - olh@suse.de
 
diff --git a/pam_krb5.spec b/pam_krb5.spec
index e4798ed..2eaeade 100644
--- a/pam_krb5.spec
+++ b/pam_krb5.spec
@@ -31,7 +31,7 @@ Obsoletes:      pam_krb5-64bit
 %endif
 #
 Version:        2.3.1
-Release:        43
+Release:        46
 Summary:        PAM Module for Kerberos Authentication
 Url:            http://sourceforge.net/projects/pam-krb5/
 Source:         pam_krb5-%{version}-%{PAM_RELEASE}.tar.bz2
@@ -44,6 +44,7 @@ Patch6:         pam_krb5-2.3.1-post.dif
 Patch7:         bug-425861_pam_krb5-2.3.1-ccacheperms.patch
 Patch8:         pam_krb5-2.3.1-fix-pwchange-with-use_shmem.dif
 Patch9:         pam_krb5-2.3.1-switch-perms-on-refresh.dif
+Patch10:        pam_krb5-2.2.3-1-setcred-assume-establish.dif
 BuildRoot:      %{_tmppath}/%{name}-%{version}-build
 
 %description
@@ -68,6 +69,7 @@ Authors:
 %patch7 -p1
 %patch8 -p1
 %patch9 -p1
+%patch10
 
 %build
 %{suse_update_config -f}
@@ -102,6 +104,9 @@ rm -rf $RPM_BUILD_ROOT
 %attr(755,root,root) /usr/bin/afs5log
 
 %changelog
+* Mon Feb 02 2009 mc@suse.de
+- pam_sm_setcred should assume PAM_ESTABLISH_CRED
+  if no flag are passed (bnc#470414)
 * Tue Jan 13 2009 olh@suse.de
 - obsolete old -XXbit packages (bnc#437293)
 * Fri Nov 21 2008 mc@suse.de