PT-2004-1885 · Openldap+1 · Openldap+1

Publicado 2004-09-07 · Atualizado 2017-10-11 · CVE-2004-0823

Positive Technologies (AI Summary)

CVSS v2.0

7.5

Alta

Vetor base

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions OpenLDAP versions 1.0 through 2.1.19

Description The issue allows certain authentication schemes to use hashed (crypt) passwords in the userPassword attribute as if they were plaintext passwords. This enables remote attackers to re-use hashed passwords without decrypting them.

Recommendations For OpenLDAP versions 1.0 through 2.1.19, consider updating to a version where this issue is resolved, although the specific fixed version is not provided in the available data. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Identificadores relacionados

CVE-2004-0823

RHSA-2005:751

RHSA-2005_751

Produtos afetados

Openldap

Red Hat

Referências · 14

• http://secunia.com/advisories/12491 · Aviso do Fabricante
• http://redhat.com/support/errata/RHSA-2005-751.html · Aviso do Fabricante
• http://securityfocus.com/bid/11137 · Aviso do Fabricante
• https://rhn.redhat.com/errata/RHSA-2005-751.html · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2004-0823 · Nota de Segurança
• http://securityfocus.com/advisories/7148 · Aviso do Fabricante
• http://secunia.com/advisories/17233 · Nota
• https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10703 · Nota
• http://auscert.org.au/render.html?it=4363 · Aviso do Fabricante
• https://exchange.xforce.ibmcloud.com/vulnerabilities/17300 · Nota
• https://redhat.com/security/data/cve/CVE-2004-0823.html · Nota
• https://redhat.com/security/data/cve/CVE-2005-2069.html · Nota
• http://support.avaya.com/elmodocs2/security/ASA-2006-157.htm · Nota
• http://secunia.com/advisories/21520 · Nota