PT-2006-1016 · Red Hat+1 · Fedora Core+2

Steve Rigler · Publicado 2006-10-04 · Atualizado 2022-02-25 · CVE-2006-5170

Positive Technologies (AI Summary)

CVSS v2.0

7.5

Alta

Vetor base

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions: nss ldap versions prior to the fixed version libpam-ldap (affected versions not specified) Red Hat Enterprise Linux 4 Fedora Core 3 and earlier

Description: The issue concerns multiple vulnerabilities in the libpam-ldap package of the Debian GNU/Linux operating system, which can lead to breaches of confidentiality, integrity, and availability of protected information. Exploitation can be carried out remotely. Specifically, in nss ldap, when an LDAP directory server responds with a PasswordPolicyResponse control response, the pam authenticate function returns a success code even if authentication has failed.

Recommendations: For nss ldap on Red Hat Enterprise Linux 4 and Fedora Core 3 and earlier, update to a version that correctly handles the PasswordPolicyResponse control response from the LDAP directory server. For libpam-ldap, at the moment, there is no information about a newer version that contains a fix for this vulnerability. As a temporary workaround, consider restricting access to the pam authenticate function until a patch is available.

Improper Handling of Exceptional Conditions

Enumeração de Fraquezas

CWE-755

Identificadores relacionados

BDU:2015-03073

CVE-2006-5170

DSA-1203-1

RHSA-2006:0719

RHSA-2006_0719

Produtos afetados

Debian

Fedora Core

Red Hat

Referências · 30

• http://novell.com/linux/security/advisories/2006_27_sr.html · Aviso do Fabricante
• http://debian.org/security/2006/dsa-1203 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2006-5170 · Nota de Segurança
• https://issues.rpath.com/browse/RPL-680 · Nota
• https://security-tracker.debian.org/tracker/CVE-2006-5170 · Aviso do Fabricante
• https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10418 · Nota
• http://secunia.com/advisories/22696 · Nota
• http://debian.org/security/dsa-1203 · Nota
• http://secunia.com/advisories/22869 · Nota
• http://trustix.org/errata/2006/0061 · Aviso do Fabricante
• http://mandriva.com/security/advisories?name=MDKSA-2006:201 · Aviso do Fabricante
• https://osv.dev/vulnerability/CVE-2006-5170 · Aviso do Fabricante
• http://securitytracker.com/id?1017153 · Nota
• https://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=207286 · Aviso do Fabricante
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-5170 · Nota de Segurança