PT-2010-2557 · Likewise · Likewise Open+1

Matt Weatherford · Published 2010-07-27 · Updated 2018-10-10 · CVE-2010-0833

Positive Technologies (AI Summary)

CVSS v2.0

9.3

High

Base vector

AV:N/AC:M/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Likewise Open versions 5.4 through 5.4 before build 8046 Likewise Open versions 6.0 through 6.0 before build 8234 CIFS versions 5.4 through 5.4 before build 8046 CIFS versions 6.0 through 6.0 before build 8234

Description The issue allows remote attackers to bypass authentication for a Likewise Security Authority (lsassd) account whose password is marked as expired, due to the use of "SetPassword logic" when running as part of a root service.

Recommendations For Likewise Open versions 5.4 through 5.4 before build 8046, update to build 8046 or later. For Likewise Open versions 6.0 through 6.0 before build 8234, update to build 8234 or later. For CIFS versions 5.4 through 5.4 before build 8046, update to build 8046 or later. For CIFS versions 6.0 through 6.0 before build 8234, update to build 8234 or later.

Fix

Improper Authentication

Weakness Enumeration

CWE-287

Related Identifiers

CVE-2010-0833

Affected Products

Cifs

Likewise Open

References · 11

• http://vupen.com/english/advisories/2011/0312 · Vendor Advisory
• http://secunia.com/advisories/40736 · Vendor Advisory
• http://secunia.com/advisories/43244 · Vendor Advisory
• http://likewise.com/community/index.php/forums/viewthread/772 · Vendor Advisory
• http://vupen.com/english/advisories/2010/1913 · Vendor Advisory
• http://marc.info/?l=bugtraq&m=129719002806096&w=2 · Vendor Advisory
• http://secunia.com/advisories/40725 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2010-0833 · Security Note
• http://ubuntu.com/usn/USN-964-1 · Vendor Advisory
• http://securitytracker.com/id?1025031 · Note
• http://securityfocus.com/archive/1/512643/100/0/threaded · Note