PT-2007-1033 · None · Ldap Account Manager

Published 2007-04-03 · Updated 2008-09-05 · CVE-2006-7191

Positive Technologies (AI Summary)

CVSS v2.0

7.2

High

Base vector

AV:L/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions: LDAP Account Manager versions prior to 1.0.0

Description: The issue concerns an untrusted search path vulnerability in the lamdaemon.pl script of LDAP Account Manager. This vulnerability allows local users to gain privileges by modifying the PATH environment variable to point to a malicious program, such as a modified rm program. Additionally, there are multiple vulnerabilities in the ldap-account-manager package that can lead to breaches of confidentiality, integrity, and availability of protected information. These vulnerabilities can be exploited by a local attacker.

Recommendations: For versions prior to 1.0.0, update to version 1.0.0 or later to resolve the issue. As a temporary workaround, consider restricting access to the lamdaemon.pl script and ensuring that the PATH environment variable is properly set to prevent malicious program execution.

Fix

Related Identifiers

BDU:2015-03034

CVE-2006-7191

DSA-1287-1

Affected Products

Ldap Account Manager

References · 14

• https://security-tracker.debian.org/tracker/CVE-2006-7191 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2006-7191 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2006-7191 · Vendor Advisory
• http://us.debian.org/security/2007/dsa-1287 · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-7191 · Security Note
• https://bdu.fstec.ru/vul/2015-03034 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-1840 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2006-7191 · Security Note
• http://lam.cvs.sourceforge.net/lam/lam/lib/lamdaemon.pl · Note
• http://debian.org/security/dsa-1287 · Note
• http://secunia.com/advisories/25157 · Note
• http://lam.sourceforge.net/changelog/index.htm · Note
• http://securityfocus.com/bid/23857 · Note
• http://lam.cvs.sourceforge.net/lam/lam/lib/lamdaemon.pl?r1=1.32&r2=1.33 · Note