Vulnerability in Debian Linux
CVE-2006-5170
pam_ldap in nss_ldap on Red Hat Enterprise Linux 4, Fedora Core 3 and earlier, and possibly other distributions does not return an error condition when an LDAP directory server responds with a PasswordPolicyResponse control response, which causes the pam_authenticate function to return a success code even if authentication has failed, as originally reported for xscreensaver.
EPSS: 0.038 (89.0th percentile) — read the EPSS interpretation.
Affected products
- Debian Debian_linux — versions 3.1
- Fedoraproject Fedora_core
- Redhat Enterprise_linux — versions 4.0
- Redhat Enterprise_linux_desktop — versions 4.0
- Redhat Enterprise_linux_for_ibm_z_systems — versions 4.0_s390, 4.0_s390x
- Redhat Enterprise_linux_for_power_big_endian — versions 4.0
- Redhat Enterprise_linux_server — versions 4.0
- Redhat Enterprise_linux_workstation — versions 4.0
- N/a — versions n/a
Weakness classification (CWE)
References
- secalert@redhat.com (VDB Entry, Third Party Advisory, vdb-entry, x_refsource_SECTRACK)
- secalert@redhat.com (x_refsource_REDHAT, vendor-advisory, Vendor Advisory)
- secalert@redhat.com (x_refsource_CONFIRM, Third Party Advisory, Broken Link)
- secalert@redhat.com (x_refsource_SECUNIA, Third Party Advisory, third-party-advisory)
- secalert@redhat.com (mailing-list, x_refsource_BUGTRAQ, VDB Entry, Third Party Advisory)
- secalert@redhat.com (vendor-advisory, Third Party Advisory, x_refsource_TRUSTIX, Broken Link)
- secalert@redhat.com (VDB Entry, Third Party Advisory, vdb-entry, x_refsource_BID)
- secalert@redhat.com (x_refsource_SECUNIA, Third Party Advisory, third-party-advisory)
- secalert@redhat.com (vendor-advisory, Third Party Advisory, x_refsource_MANDRIVA)
- secalert@redhat.com (vendor-advisory, Broken Link, x_refsource_SUSE, Vendor Advisory)