PT-2005-4353 · Ibm · Ibm Tivoli Directory Server

Published 2005-11-16 · Updated 2017-07-11 · CVE-2005-3567

Positive Technologies (AI Summary)

CVSS v2.0

5.8

Medium

Base vector

AV:A/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions IBM Tivoli Directory Server (ITDS) versions 5.2.0 through 6.0.0

Description The issue allows attackers to bypass authentication and modify or delete directory data. This is possible because the slapd daemon in the affected software binds using SASL EXTERNAL.

Recommendations For versions 5.2.0 through 6.0.0, consider restricting access to the slapd daemon until a fix is available. As a temporary workaround, review and limit the use of SASL EXTERNAL bindings to minimize the risk of exploitation.

Fix

Weakness Enumeration

CWE-264

Related Identifiers

CVE-2005-3567

Affected Products

Ibm Tivoli Directory Server

References · 13

• http://securityfocus.com/bid/15367 · Patch
• http://www-1.ibm.com/support/docview.wss?uid=swg21222159 · Vendor Advisory
• http://www-1.ibm.com/support/search.wss?rs=0&q=IO02697&apar=only · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2005-3567 · Security Note
• http://osvdb.org/20672 · Patch
• http://vupen.com/english/advisories/2005/2356 · Vendor Advisory
• http://securitytracker.com/id?1015171 · Patch
• http://secunia.com/advisories/17484 · Vendor Advisory
• http://www-1.ibm.com/support/search.wss?rs=0&q=IO02714&apar=only · Vendor Advisory
• http://www-1.ibm.com/support/docview.wss?rs=767&context=SSVJJU&dc=D400&uid=swg24010819&loc=en_US&cs=UTF-8&lang=en · Vendor Advisory
• https://exchange.xforce.ibmcloud.com/vulnerabilities/22989 · Note
• http://www-1.ibm.com/support/docview.wss?uid=isg1SSRVAIX53SECUR081510_247 · Note
• http://kb.cert.org/vuls/id/194753 · Note