PT-2006-1016 · Red Hat+1 · Fedora Core+2

Steve Rigler · Published 2006-10-04 · Updated 2022-02-25 · CVE-2006-5170

Positive Technologies (AI Summary)

CVSS v2.0

7.5

High

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions: nss ldap versions prior to the fixed version libpam-ldap (affected versions not specified) Red Hat Enterprise Linux 4 Fedora Core 3 and earlier

Description: The issue concerns multiple vulnerabilities in the libpam-ldap package of the Debian GNU/Linux operating system, which can lead to breaches of confidentiality, integrity, and availability of protected information. Exploitation can be carried out remotely. Specifically, in nss ldap, when an LDAP directory server responds with a PasswordPolicyResponse control response, the pam authenticate function returns a success code even if authentication has failed.

Recommendations: For nss ldap on Red Hat Enterprise Linux 4 and Fedora Core 3 and earlier, update to a version that correctly handles the PasswordPolicyResponse control response from the LDAP directory server. For libpam-ldap, at the moment, there is no information about a newer version that contains a fix for this vulnerability. As a temporary workaround, consider restricting access to the pam authenticate function until a patch is available.

Improper Handling of Exceptional Conditions

Weakness Enumeration

CWE-755

Related Identifiers

BDU:2015-03073

CVE-2006-5170

DSA-1203-1

RHSA-2006:0719

RHSA-2006_0719

Affected Products

Debian

Fedora Core

Red Hat

References · 30

• http://novell.com/linux/security/advisories/2006_27_sr.html · Vendor Advisory
• http://debian.org/security/2006/dsa-1203 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2006-5170 · Security Note
• https://security-tracker.debian.org/tracker/CVE-2006-5170 · Vendor Advisory
• http://trustix.org/errata/2006/0061 · Vendor Advisory
• http://mandriva.com/security/advisories?name=MDKSA-2006:201 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2006-5170 · Vendor Advisory
• https://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=207286 · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-5170 · Security Note
• https://osv.dev/vulnerability/DEBIAN-CVE-2006-5170 · Vendor Advisory
• http://security.gentoo.org/glsa/glsa-200612-19.xml · Vendor Advisory
• https://bdu.fstec.ru/vul/2015-03073 · Security Note
• http://bugzilla.padl.com/show_bug.cgi?id=291 · Vendor Advisory
• http://rhn.redhat.com/errata/RHSA-2006-0719.html · Vendor Advisory
• https://issues.rpath.com/browse/RPL-680 · Note