Executive Summary
Summary | |
---|---|
Title | nss_ldap security update |
Informations | |||
---|---|---|---|
Name | RHSA-2006:0719 | First vendor Publication | 2006-11-15 |
Vendor | RedHat | Last vendor Modification | 2006-11-15 |
Severity (Vendor) | Moderate | Revision | 01 |
Security-Database Scoring CVSS v3
Cvss vector : N/A | |||
---|---|---|---|
Overall CVSS Score | NA | ||
Base Score | NA | Environmental Score | NA |
impact SubScore | NA | Temporal Score | NA |
Exploitabality Sub Score | NA | ||
Calculate full CVSS 3.0 Vectors scores |
Security-Database Scoring CVSS v2
Cvss vector : (AV:N/AC:L/Au:N/C:P/I:P/A:P) | |||
---|---|---|---|
Cvss Base Score | 7.5 | Attack Range | Network |
Cvss Impact Score | 6.4 | Attack Complexity | Low |
Cvss Expoit Score | 10 | Authentication | None Required |
Calculate full CVSS 2.0 Vectors scores |
Detail
Problem Description: Updated nss_ldap packages that fix a security flaw are now available for Red Hat Enterprise Linux 4. This update has been rated as having moderate security impact by the Red Hat Security Response Team. 2. Relevant releases/architectures: Red Hat Enterprise Linux AS version 4 - i386, ia64, ppc, s390, s390x, x86_64 Red Hat Enterprise Linux Desktop version 4 - i386, x86_64 Red Hat Enterprise Linux ES version 4 - i386, ia64, x86_64 Red Hat Enterprise Linux WS version 4 - i386, ia64, x86_64 3. Problem description: nss_ldap is a set of C library extensions that allow X.500 and LDAP directory servers to be used as primary sources for aliases, ethers, groups, hosts, networks, protocols, users, RPCs, services, and shadow passwords. A flaw was found in the way nss_ldap handled a PasswordPolicyResponse control sent by an LDAP server. If an LDAP server responded to an authentication request with a PasswordPolicyResponse control, it was possible for an application using nss_ldap to improperly authenticate certain users. (CVE-2006-5170) This flaw was only exploitable within applications which did not properly process nss_ldap error messages. Only xscreensaver is currently known to exhibit this behavior. All users of nss_ldap should upgrade to these updated packages, which contain a backported patch that resolves this issue. 4. Solution: Before applying this update, make sure all previously released errata relevant to your system have been applied. This update is available via Red Hat Network. To use Red Hat Network, launch the Red Hat Update Agent with the following command: up2date This will start an interactive process that will result in the appropriate RPMs being upgraded on your system. 5. Bug IDs fixed (http://bugzilla.redhat.com/): 207286 - CVE-2006-5170 When using LDAP for authentication, xscreensaver allows access if account locked out. |
Original Source
Url : https://rhn.redhat.com/errata/RHSA-2006-0719.html |
CWE : Common Weakness Enumeration
% | Id | Name |
---|---|---|
100 % | CWE-755 | Improper Handling of Exceptional Conditions |
OVAL Definitions
Definition Id: oval:org.mitre.oval:def:10418 | |||
Oval ID: | oval:org.mitre.oval:def:10418 | ||
Title: | pam_ldap in nss_ldap on Red Hat Enterprise Linux 4, Fedora Core 3 and earlier, and possibly other distributions does not return an error condition when an LDAP directory server responds with a PasswordPolicyResponse control response, which causes the pam_authenticate function to return a success code even if authentication has failed, as originally reported for xscreensaver. | ||
Description: | pam_ldap in nss_ldap on Red Hat Enterprise Linux 4, Fedora Core 3 and earlier, and possibly other distributions does not return an error condition when an LDAP directory server responds with a PasswordPolicyResponse control response, which causes the pam_authenticate function to return a success code even if authentication has failed, as originally reported for xscreensaver. | ||
Family: | unix | Class: | vulnerability |
Reference(s): | CVE-2006-5170 | Version: | 5 |
Platform(s): | Red Hat Enterprise Linux 4 CentOS Linux 4 Oracle Linux 4 | Product(s): | |
Definition Synopsis: | |||
CPE : Common Platform Enumeration
Type | Description | Count |
---|---|---|
Os | 1 | |
Os | 1 | |
Os | 2 | |
Os | 1 | |
Os | 2 | |
Os | 1 | |
Os | 1 | |
Os | 1 |
OpenVAS Exploits
Date | Description |
---|---|
2009-10-10 | Name : SLES9: Security update for pam_ldap File : nvt/sles9p5017445.nasl |
2008-09-24 | Name : Gentoo Security Advisory GLSA 200612-19 (pam_ldap) File : nvt/glsa_200612_19.nasl |
2008-01-17 | Name : Debian Security Advisory DSA 1203-1 (libpam-ldap) File : nvt/deb_1203_1.nasl |
Open Source Vulnerability Database (OSVDB)
Id | Description |
---|---|
30189 | pam_ldap PasswordPolicyResponse Authentication Bypass |
Nessus® Vulnerability Scanner
Date | Description |
---|---|
2013-07-12 | Name : The remote Oracle Linux host is missing a security update. File : oraclelinux_ELSA-2006-0719.nasl - Type : ACT_GATHER_INFO |
2009-09-24 | Name : The remote SuSE 9 host is missing a security-related patch. File : suse9_11259.nasl - Type : ACT_GATHER_INFO |
2009-04-23 | Name : The remote CentOS host is missing a security update. File : centos_RHSA-2006-0719.nasl - Type : ACT_GATHER_INFO |
2007-12-13 | Name : The remote SuSE 10 host is missing a security-related patch. File : suse_pam_ldap-2196.nasl - Type : ACT_GATHER_INFO |
2007-10-17 | Name : The remote openSUSE host is missing a security update. File : suse_pam_ldap-2194.nasl - Type : ACT_GATHER_INFO |
2007-02-18 | Name : The remote Mandrake Linux host is missing a security update. File : mandrake_MDKSA-2006-201.nasl - Type : ACT_GATHER_INFO |
2006-12-30 | Name : The remote Gentoo host is missing one or more security-related patches. File : gentoo_GLSA-200612-19.nasl - Type : ACT_GATHER_INFO |
2006-11-20 | Name : The remote Red Hat host is missing a security update. File : redhat-RHSA-2006-0719.nasl - Type : ACT_GATHER_INFO |
2006-11-06 | Name : The remote Debian host is missing a security-related update. File : debian_DSA-1203.nasl - Type : ACT_GATHER_INFO |
Alert History
Date | Informations |
---|---|
2014-02-17 11:50:17 |
|