PT-2009-1033 · Nss Ldap · Nss Ldap

Vincent Danen

·

CVE-2009-1073

·

Publicado

2009-03-31

·

Atualizado

2024-02-15

CVSS v2.0

4.9

Média

VetorAV:L/AC:L/Au:N/C:C/I:N/A:N
Name of the Vulnerable Software and Affected Versions nss-ldapd versions prior to 0.6.8
Description The issue is related to errors in privilege management, allowing a local user to obtain the cleartext password for the LDAP server. This can be achieved by reading the bindpw field from the /etc/nss-ldapd.conf file, which has world-readable permissions. The exploitation of this issue may lead to a breach of confidentiality of protected information.
Recommendations For versions prior to 0.6.8, update to version 0.6.8 or later to resolve the issue. As a temporary workaround, consider changing the permissions of the /etc/nss-ldapd.conf file to restrict access to sensitive information.

Exploit

Correção

Incorrect Permission

Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
dbugs@ptsecurity.com

Enumeração de Fraquezas

CWE-264CWE-732

Identificadores relacionados

BDU:2015-03469
BDU:2019-03974
CVE-2009-1073
DSA-1758-1

Produtos afetados

Nss Ldap