Arthur de Jong 'nss-pam-ldapd' Authentication Bypass Vulnerability

2011.03.17

Credit: Russell Sim

Risk: Medium

Local: No

Remote: Yes

CVE: CVE-2011-0438

CWE: CWE-287

CVSS Base Score: 6.8/10

Impact Subscore: 6.4/10

Exploitability Subscore: 8.6/10

Exploit range: Remote

Attack complexity: Medium

Authentication: No required

Confidentiality impact: Partial

Integrity impact: Partial

Availability impact: Partial

Index: nslcd/pam.c
===================================================================
--- nslcd/pam.c	(revision 1381)
+++ nslcd/pam.c	(working copy)
@@ -106,7 +106,7 @@
     if (entry==NULL)
     {
       log_log(LOG_WARNING,"\"%s\": user not found: %s",username,ldap_err2string(rc));
-      return rc;
+      return LDAP_NO_SUCH_OBJECT;
     }
     /* get the DN */
     myldap_cpy_dn(entry,userdn,userdnsz);

References:

http://www.securityfocus.com/bid/46819

http://lists.arthurdejong.org/nss-pam-ldapd-announce/2011/msg00000.html

http://lists.arthurdejong.org/nss-pam-ldapd-announce/2011/attachments/txtVf3rHgt8qQ.txt

http://xforce.iss.net/xforce/xfdb/66028

http://arthurdejong.org/nss-pam-ldapd/news.html#20110309

Vote for this issue:

50%

Comment it here.

Nick (*)

Email (*)

Video

Text (*)

(*) - required fields.

{{ x.nick }} | Date: {{ x.ux * 1000 | date:'yyyy-MM-dd' }} {{ x.ux * 1000 | date:'HH:mm' }} CET+1

{{ x.comment }}