PT-2010-2557 · Likewise · Likewise Open+1

Matt Weatherford · Publicado 2010-07-27 · Atualizado 2018-10-10 · CVE-2010-0833

Positive Technologies (AI Summary)

CVSS v2.0

9.3

Alta

Vetor base

AV:N/AC:M/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Likewise Open versions 5.4 through 5.4 before build 8046 Likewise Open versions 6.0 through 6.0 before build 8234 CIFS versions 5.4 through 5.4 before build 8046 CIFS versions 6.0 through 6.0 before build 8234

Description The issue allows remote attackers to bypass authentication for a Likewise Security Authority (lsassd) account whose password is marked as expired, due to the use of "SetPassword logic" when running as part of a root service.

Recommendations For Likewise Open versions 5.4 through 5.4 before build 8046, update to build 8046 or later. For Likewise Open versions 6.0 through 6.0 before build 8234, update to build 8234 or later. For CIFS versions 5.4 through 5.4 before build 8046, update to build 8046 or later. For CIFS versions 6.0 through 6.0 before build 8234, update to build 8234 or later.

Correção

Improper Authentication

Enumeração de Fraquezas

CWE-287

Identificadores relacionados

CVE-2010-0833

Produtos afetados

Cifs

Likewise Open

Referências · 11

• http://vupen.com/english/advisories/2011/0312 · Aviso do Fabricante
• http://secunia.com/advisories/40736 · Aviso do Fabricante
• http://secunia.com/advisories/43244 · Aviso do Fabricante
• http://likewise.com/community/index.php/forums/viewthread/772 · Aviso do Fabricante
• http://vupen.com/english/advisories/2010/1913 · Aviso do Fabricante
• http://marc.info/?l=bugtraq&m=129719002806096&w=2 · Aviso do Fabricante
• http://secunia.com/advisories/40725 · Aviso do Fabricante
• http://securitytracker.com/id?1025031 · Nota
• http://securityfocus.com/archive/1/512643/100/0/threaded · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2010-0833 · Nota de Segurança
• http://ubuntu.com/usn/USN-964-1 · Aviso do Fabricante