Lucene search

[email protected]CVE-2004-1997

HistoryMay 05, 2004 - 4:00 a.m.

CVE-2004-1997

2004-05-0504:00:00

NVD-CWE-Other

[email protected]

web.nvd.nist.gov

cve-2004-1997

kolab

openldap

plaintext passwords

slapd.conf

world-readable

local privilege escalation

nvd

6.7 Medium

AI Score

Confidence

Low

4.6 Medium

CVSS2

Access Vector

LOCAL

Access Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:L/AC:L/Au:N/C:P/I:P/A:P

0.001 Low

EPSS

Percentile

25.7%

JSON

Kolab stores OpenLDAP passwords in plaintext in the slapd.conf file, which may be installed world-readable, which allows local users to gain privileges.

CPENameOperatorVersion
kolab:kolab_groupware_serverkolab kolab groupware servereq1.0
openpkg:openpkgopenpkgeq2.0
kolab:kolab_groupware_serverkolab kolab groupware servereq1.0.7
kolab:kolab_groupware_serverkolab kolab groupware servereq1.0.6
kolab:kolab_groupware_serverkolab kolab groupware servereq1.0.5
kolab:kolab_groupware_serverkolab kolab groupware servereq1.0.3
kolab:kolab_groupware_serverkolab kolab groupware servereq1.0.8
kolab:kolab_groupware_serverkolab kolab groupware servereq1.0.1

CPE	Name	Operator	Version
kolab:kolab_groupware_server	kolab kolab groupware server	eq	1.0
openpkg:openpkg	openpkg	eq	2.0
kolab:kolab_groupware_server	kolab kolab groupware server	eq	1.0.7
kolab:kolab_groupware_server	kolab kolab groupware server	eq	1.0.6
kolab:kolab_groupware_server	kolab kolab groupware server	eq	1.0.5
kolab:kolab_groupware_server	kolab kolab groupware server	eq	1.0.3
kolab:kolab_groupware_server	kolab kolab groupware server	eq	1.0.8
kolab:kolab_groupware_server	kolab kolab groupware server	eq	1.0.1

References

marc.info/?l=bugtraq&m=108377525924422&w=2

secunia.com/advisories/11560

www.erfrakon.de/projects/kolab/download/kolab-server-1.0/src/Changelog

www.kolab.org/pipermail/kolab-users/2004-April/000215.html

www.mandriva.com/security/advisories?name=MDKSA-2004:052

www.osvdb.org/5898

www.securityfocus.com/bid/10277

exchange.xforce.ibmcloud.com/vulnerabilities/16068

6.7 Medium

AI Score

Confidence

Low

4.6 Medium

CVSS2

Access Vector

LOCAL

Access Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:L/AC:L/Au:N/C:P/I:P/A:P

0.001 Low

EPSS

Percentile

25.7%

JSON

Related for CVE-2004-1997

nessus1 cvelist1