PT-2020-7073 · Hewlett Packard+1 · Hp-Ux Directory Server+1

Vincent Danen · Published 2020-01-09 · Updated 2020-01-29 · CVE-2010-3282

Positive Technologies (AI Summary)

CVSS v2.0

1.9

Low

Base vector

AV:L/AC:M/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions 389 Directory Server versions prior to 1.2.7.1 HP-UX Directory Server versions prior to B.08.10.03

Description The issue allows local users to obtain sensitive information by reading the log when audit logging is enabled. This occurs because the Directory Manager password (nsslapd-rootpw) is logged in cleartext when changing cn=config:nsslapd-rootpw.

Recommendations For 389 Directory Server versions prior to 1.2.7.1, update to version 1.2.7.1 or later to resolve the issue. For HP-UX Directory Server versions prior to B.08.10.03, update to version B.08.10.03 or later to resolve the issue. As a temporary workaround, consider disabling audit logging until a patch is available.

Fix

Cleartext Storage of Sensitive Information

Weakness Enumeration

CWE-312

Related Identifiers

CVE-2010-3282

Affected Products

389 Directory Server

Hp-Ux Directory Server

References · 6

• https://nvd.nist.gov/vuln/detail/CVE-2010-3282 · Security Note
• https://support.hpe.com/hpsc/doc/public/display?docId=emr_na-c02522633&docLocale=en_US · Vendor Advisory
• https://t.me/cibsecurity/9099 · Telegram Post
• https://bugzilla.redhat.com/show_bug.cgi?id=625950 · Note
• https://git.fedorahosted.org/cgit/389/ds.git/commit/?id=d38ae06 · Note
• http://oval.mitre.org/repository/data/getDef?id=oval:org.mitre.oval:def:6914 · Note