ID |
CVE-2006-5170
|
Summary |
pam_ldap in nss_ldap on Red Hat Enterprise Linux 4, Fedora Core 3 and earlier, and possibly other distributions does not return an error condition when an LDAP directory server responds with a PasswordPolicyResponse control response, which causes the pam_authenticate function to return a success code even if authentication has failed, as originally reported for xscreensaver. |
References |
|
Vulnerable Configurations |
-
cpe:2.3:o:redhat:enterprise_linux:4.0:*:linux_kernel_2.6.9:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux:4.0:*:linux_kernel_2.6.9:*:*:*:*:*
-
cpe:2.3:o:fedoraproject:fedora_core:-:*:*:*:*:*:*:*
cpe:2.3:o:fedoraproject:fedora_core:-:*:*:*:*:*:*:*
-
cpe:2.3:o:fedoraproject:fedora_core:1:*:*:*:*:*:*:*
cpe:2.3:o:fedoraproject:fedora_core:1:*:*:*:*:*:*:*
-
cpe:2.3:o:fedoraproject:fedora_core:2:*:*:*:*:*:*:*
cpe:2.3:o:fedoraproject:fedora_core:2:*:*:*:*:*:*:*
-
cpe:2.3:o:fedoraproject:fedora_core:3:*:*:*:*:*:*:*
cpe:2.3:o:fedoraproject:fedora_core:3:*:*:*:*:*:*:*
-
cpe:2.3:o:fedoraproject:fedora_core:4:*:*:*:*:*:*:*
cpe:2.3:o:fedoraproject:fedora_core:4:*:*:*:*:*:*:*
-
cpe:2.3:o:fedoraproject:fedora_core:5:*:*:*:*:*:*:*
cpe:2.3:o:fedoraproject:fedora_core:5:*:*:*:*:*:*:*
-
cpe:2.3:o:fedoraproject:fedora_core:6:*:*:*:*:*:*:*
cpe:2.3:o:fedoraproject:fedora_core:6:*:*:*:*:*:*:*
-
cpe:2.3:o:redhat:enterprise_linux:4.0:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux:4.0:*:*:*:*:*:*:*
-
cpe:2.3:o:redhat:enterprise_linux_desktop:4.0:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux_desktop:4.0:*:*:*:*:*:*:*
-
cpe:2.3:o:redhat:enterprise_linux_for_ibm_z_systems:4.0_s390:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux_for_ibm_z_systems:4.0_s390:*:*:*:*:*:*:*
-
cpe:2.3:o:redhat:enterprise_linux_for_ibm_z_systems:4.0_s390x:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux_for_ibm_z_systems:4.0_s390x:*:*:*:*:*:*:*
-
cpe:2.3:o:redhat:enterprise_linux_for_power_big_endian:4.0:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux_for_power_big_endian:4.0:*:*:*:*:*:*:*
-
cpe:2.3:o:redhat:enterprise_linux_server:4.0:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux_server:4.0:*:*:*:*:*:*:*
-
cpe:2.3:o:redhat:enterprise_linux_workstation:4.0:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux_workstation:4.0:*:*:*:*:*:*:*
-
cpe:2.3:o:debian:debian_linux:3.1:*:*:*:*:*:*:*
cpe:2.3:o:debian:debian_linux:3.1:*:*:*:*:*:*:*
|
CVSS |
Base: | 7.5 (as of 25-02-2022 - 19:20) |
Impact: | |
Exploitability: | |
|
CWE |
CWE-755 |
CAPEC |
|
Access |
Vector | Complexity | Authentication |
NETWORK |
LOW |
NONE |
|
Impact |
Confidentiality | Integrity | Availability |
PARTIAL |
PARTIAL |
PARTIAL |
|
cvss-vector
via4
|
AV:N/AC:L/Au:N/C:P/I:P/A:P
|
oval
via4
|
accepted | 2013-04-29T04:05:30.287-04:00 | class | vulnerability | contributors | name | Aharon Chernin | organization | SCAP.com, LLC |
name | Dragos Prisaca | organization | G2, Inc. |
| definition_extensions | comment | The operating system installed on the system is Red Hat Enterprise Linux 4 | oval | oval:org.mitre.oval:def:11831 |
comment | CentOS Linux 4.x | oval | oval:org.mitre.oval:def:16636 |
comment | Oracle Linux 4.x | oval | oval:org.mitre.oval:def:15990 |
| description | pam_ldap in nss_ldap on Red Hat Enterprise Linux 4, Fedora Core 3 and earlier, and possibly other distributions does not return an error condition when an LDAP directory server responds with a PasswordPolicyResponse control response, which causes the pam_authenticate function to return a success code even if authentication has failed, as originally reported for xscreensaver. | family | unix | id | oval:org.mitre.oval:def:10418 | status | accepted | submitted | 2010-07-09T03:56:16-04:00 | title | pam_ldap in nss_ldap on Red Hat Enterprise Linux 4, Fedora Core 3 and earlier, and possibly other distributions does not return an error condition when an LDAP directory server responds with a PasswordPolicyResponse control response, which causes the pam_authenticate function to return a success code even if authentication has failed, as originally reported for xscreensaver. | version | 29 |
|
redhat
via4
|
advisories | bugzilla | id | 1618208 | title | CVE-2006-5170 security flaw |
| oval | OR | comment | Red Hat Enterprise Linux must be installed | oval | oval:com.redhat.rhba:tst:20070304026 |
AND | comment | Red Hat Enterprise Linux 4 is installed | oval | oval:com.redhat.rhba:tst:20070304025 |
comment | nss_ldap is earlier than 0:226-17 | oval | oval:com.redhat.rhsa:tst:20060719001 |
comment | nss_ldap is signed with Red Hat master key | oval | oval:com.redhat.rhsa:tst:20060719002 |
|
|
| rhsa | id | RHSA-2006:0719 | released | 2006-11-15 | severity | Moderate | title | RHSA-2006:0719: nss_ldap security update (Moderate) |
|
| rpms | - nss_ldap-0:226-17
- nss_ldap-debuginfo-0:226-17
|
|
refmap
via4
|
bid | 20880 | bugtraq | 20061005 rPSA-2006-0183-1 nss_ldap | confirm | | debian | DSA-1203 | gentoo | GLSA-200612-19 | mandriva | MDKSA-2006:201 | sectrack | 1017153 | secunia | - 22682
- 22685
- 22694
- 22696
- 22869
- 23132
- 23428
| suse | SUSE-SR:2006:027 | trustix | 2006-0061 | vupen | ADV-2006-4319 |
|
Last major update |
25-02-2022 - 19:20 |
Published |
10-10-2006 - 04:06 |
Last modified |
25-02-2022 - 19:20 |