PT-2005-1098 · Openldap+1 · Openldap+1

Published 2005-12-15 · Updated 2008-09-05 · CVE-2005-4443

Positive Technologies (AI Summary)

CVSS v2.0

7.2

High

Base vector

AV:L/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions openldap versions prior to 2.2.28-r3 Gauche versions prior to 0.8.6-r1

Description The issue concerns multiple vulnerabilities in the openldap package and an untrusted search path vulnerability in Gauche. These vulnerabilities can be exploited locally, potentially leading to breaches of confidentiality, integrity, and availability of protected information. In the case of Gauche, local users in the portage group can gain privileges via a malicious shared object in the Portage temporary build directory, which is part of the RUNPATH.

Recommendations For openldap versions prior to 2.2.28-r3, update to version 2.2.28-r3 or later to resolve the issue. For Gauche versions prior to 0.8.6-r1, update to version 0.8.6-r1 or later to address the untrusted search path vulnerability. As a temporary workaround for Gauche, consider restricting access to the Portage temporary build directory to minimize the risk of exploitation.

Fix

Related Identifiers

BDU:2015-09493

CVE-2005-4443

Affected Products

Gauche

Openldap

References · 6

• http://securityfocus.com/bid/15120 · Patch
• https://bdu.fstec.ru/vul/2015-09493 · Security Note
• http://secunia.com/advisories/18040 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2005-4443 · Security Note
• http://security.gentoo.org/glsa/glsa-200512-07.xml · Note
• http://gentoo.org/security/en/glsa/glsa-200512-07.xml · Patch, Vendor Advisory