CVE-2006-5170

pam_ldap - Info Disclosure

Title source: llm
STIX 2.1

Description

pam_ldap in nss_ldap on Red Hat Enterprise Linux 4, Fedora Core 3 and earlier, and possibly other distributions does not return an error condition when an LDAP directory server responds with a PasswordPolicyResponse control response, which causes the pam_authenticate function to return a success code even if authentication has failed, as originally reported for xscreensaver.

References (21)

Core 21
Core References
Third Party Advisory, VDB Entry vdb-entry x_refsource_sectrack
http://securitytracker.com/id?1017153
Vendor Advisory vendor-advisory x_refsource_redhat
http://rhn.redhat.com/errata/RHSA-2006-0719.html
Broken Link, Third Party Advisory x_refsource_confirm
https://issues.rpath.com/browse/RPL-680
Third Party Advisory third-party-advisory x_refsource_secunia
http://secunia.com/advisories/22682
Third Party Advisory, VDB Entry mailing-list x_refsource_bugtraq
http://www.securityfocus.com/archive/1/447859/100/200/threaded
Broken Link, Third Party Advisory vendor-advisory x_refsource_trustix
http://www.trustix.org/errata/2006/0061/
Third Party Advisory, VDB Entry vdb-entry x_refsource_bid
http://www.securityfocus.com/bid/20880
Third Party Advisory third-party-advisory x_refsource_secunia
http://secunia.com/advisories/22685
Third Party Advisory vendor-advisory x_refsource_mandriva
http://www.mandriva.com/security/advisories?name=MDKSA-2006:201
Broken Link, Vendor Advisory vendor-advisory x_refsource_suse
http://www.novell.com/linux/security/advisories/2006_27_sr.html
Third Party Advisory third-party-advisory x_refsource_secunia
http://secunia.com/advisories/22869
Third Party Advisory third-party-advisory x_refsource_secunia
http://secunia.com/advisories/22694
Third Party Advisory third-party-advisory x_refsource_secunia
http://secunia.com/advisories/23132
Vendor Advisory vendor-advisory x_refsource_gentoo
http://security.gentoo.org/glsa/glsa-200612-19.xml
Third Party Advisory third-party-advisory x_refsource_secunia
http://secunia.com/advisories/23428
Issue Tracking, Patch, Vendor Advisory vendor-advisory x_refsource_debian
http://www.debian.org/security/2006/dsa-1203
Broken Link, Issue Tracking, Vendor Advisory x_refsource_confirm
http://bugzilla.padl.com/show_bug.cgi?id=291
Issue Tracking, Vendor Advisory x_refsource_confirm
https://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=207286
Third Party Advisory third-party-advisory x_refsource_secunia
http://secunia.com/advisories/22696
Third Party Advisory vdb-entry x_refsource_vupen
http://www.vupen.com/english/advisories/2006/4319

Scores

EPSS 0.0373
EPSS Percentile 88.4%

Details

CWE
CWE-755
Status published
Products (9)
debian/debian_linux 3.1
fedoraproject/fedora_core < core_3.0
redhat/enterprise_linux 4.0 (2 CPE variants)
redhat/enterprise_linux_desktop 4.0
redhat/enterprise_linux_for_ibm_z_systems 4.0_s390
redhat/enterprise_linux_for_ibm_z_systems 4.0_s390x
redhat/enterprise_linux_for_power_big_endian 4.0
redhat/enterprise_linux_server 4.0
redhat/enterprise_linux_workstation 4.0
Published Oct 10, 2006
Tracked Since Feb 18, 2026