PT-2004-1885 · Openldap+1 · Openldap+1

Published 2004-09-07 · Updated 2017-10-11 · CVE-2004-0823

Positive Technologies (AI Summary)

CVSS v2.0

7.5

High

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions OpenLDAP versions 1.0 through 2.1.19

Description The issue allows certain authentication schemes to use hashed (crypt) passwords in the userPassword attribute as if they were plaintext passwords. This enables remote attackers to re-use hashed passwords without decrypting them.

Recommendations For OpenLDAP versions 1.0 through 2.1.19, consider updating to a version where this issue is resolved, although the specific fixed version is not provided in the available data. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Related Identifiers

CVE-2004-0823

RHSA-2005:751

RHSA-2005_751

Affected Products

Openldap

Red Hat

References · 14

• http://secunia.com/advisories/12491 · Vendor Advisory
• http://redhat.com/support/errata/RHSA-2005-751.html · Vendor Advisory
• http://securityfocus.com/bid/11137 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2004-0823 · Security Note
• http://securityfocus.com/advisories/7148 · Vendor Advisory
• http://auscert.org.au/render.html?it=4363 · Vendor Advisory
• https://rhn.redhat.com/errata/RHSA-2005-751.html · Note
• http://secunia.com/advisories/17233 · Note
• https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10703 · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/17300 · Note
• https://redhat.com/security/data/cve/CVE-2004-0823.html · Note
• https://redhat.com/security/data/cve/CVE-2005-2069.html · Note
• http://support.avaya.com/elmodocs2/security/ASA-2006-157.htm · Note
• http://secunia.com/advisories/21520 · Note