Description
pam_ldap in nss_ldap on Red Hat Enterprise Linux 4, Fedora Core 3 and earlier, and possibly other distributions does not return an error condition when an LDAP directory server responds with a PasswordPolicyResponse control response, which causes the pam_authenticate function to return a success code even if authentication has failed, as originally reported for xscreensaver.
References (21)
Core 21
Core References
Third Party Advisory, VDB Entry vdb-entry
x_refsource_sectrack
http://securitytracker.com/id?1017153
Vendor Advisory vendor-advisory
x_refsource_redhat
http://rhn.redhat.com/errata/RHSA-2006-0719.html
Broken Link, Third Party Advisory x_refsource_confirm
https://issues.rpath.com/browse/RPL-680
Third Party Advisory third-party-advisory
x_refsource_secunia
http://secunia.com/advisories/22682
Third Party Advisory, VDB Entry mailing-list
x_refsource_bugtraq
http://www.securityfocus.com/archive/1/447859/100/200/threaded
Broken Link, Third Party Advisory vendor-advisory
x_refsource_trustix
http://www.trustix.org/errata/2006/0061/
Third Party Advisory, VDB Entry vdb-entry
x_refsource_bid
http://www.securityfocus.com/bid/20880
Third Party Advisory third-party-advisory
x_refsource_secunia
http://secunia.com/advisories/22685
Third Party Advisory vendor-advisory
x_refsource_mandriva
http://www.mandriva.com/security/advisories?name=MDKSA-2006:201
Broken Link, Vendor Advisory vendor-advisory
x_refsource_suse
http://www.novell.com/linux/security/advisories/2006_27_sr.html
Third Party Advisory third-party-advisory
x_refsource_secunia
http://secunia.com/advisories/22869
Third Party Advisory third-party-advisory
x_refsource_secunia
http://secunia.com/advisories/22694
Third Party Advisory third-party-advisory
x_refsource_secunia
http://secunia.com/advisories/23132
Vendor Advisory vendor-advisory
x_refsource_gentoo
http://security.gentoo.org/glsa/glsa-200612-19.xml
Third Party Advisory third-party-advisory
x_refsource_secunia
http://secunia.com/advisories/23428
Third Party Advisory vdb-entry
signature
x_refsource_oval
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10418
Issue Tracking, Patch, Vendor Advisory vendor-advisory
x_refsource_debian
http://www.debian.org/security/2006/dsa-1203
Broken Link, Issue Tracking, Vendor Advisory x_refsource_confirm
http://bugzilla.padl.com/show_bug.cgi?id=291
Issue Tracking, Vendor Advisory x_refsource_confirm
https://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=207286
Third Party Advisory third-party-advisory
x_refsource_secunia
http://secunia.com/advisories/22696
Third Party Advisory vdb-entry
x_refsource_vupen
http://www.vupen.com/english/advisories/2006/4319
Scores
EPSS
0.0373
EPSS Percentile
88.4%
Details
CWE
CWE-755
Status
published
Products (9)
debian/debian_linux
3.1
fedoraproject/fedora_core
< core_3.0
redhat/enterprise_linux
4.0 (2 CPE variants)
redhat/enterprise_linux_desktop
4.0
redhat/enterprise_linux_for_ibm_z_systems
4.0_s390
redhat/enterprise_linux_for_ibm_z_systems
4.0_s390x
redhat/enterprise_linux_for_power_big_endian
4.0
redhat/enterprise_linux_server
4.0
redhat/enterprise_linux_workstation
4.0
Published
Oct 10, 2006
Tracked Since
Feb 18, 2026