{"href": "https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2005-2654", "history": [], "references": ["http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=322423", "http://www.debian.org/security/2005/dsa-790", "http://www.gentoo.org/security/en/glsa/glsa-200509-04.xml"], "lastseen": "2016-09-03T05:43:49", "bulletinFamily": "NVD", "title": "CVE-2005-2654", "cpe": ["cpe:/a:phpldapadmin:phpldapadmin:0.9.6c.4"], "viewCount": 0, "id": "CVE-2005-2654", "hash": "fbbf63a3dca43a606e2a0f079cb3c52c7c76597225e896f72d35abf1d186bfc8", "description": "phpldapadmin before 0.9.6c allows remote attackers to gain anonymous access to the LDAP server, even when disable_anon_bind is set, via an HTTP request to login.php with the anonymous_bind parameter set.", "edition": 1, "assessment": {"name": "", "href": "", "system": ""}, "cvelist": ["CVE-2005-2654"], "scanner": [], "modified": "2008-09-05T16:52:20", "cvss": {"score": 7.5, "vector": "AV:NETWORK/AC:LOW/Au:NONE/C:PARTIAL/I:PARTIAL/A:PARTIAL/"}, "objectVersion": "1.2", "reporter": "NVD", "type": "cve", "published": "2005-08-30T13:03:00", "enchantments": {"vulnersScore": 7.5}}

{"result": {"f5": [{"id": "F5:K55248799", "type": "f5", "title": "phpLDAPAdmin vulnerabilities CVE-2005-2654, CVE-2005-2792, CVE-2005-2793, CVE-2006-2016, and CVE-2009-4427", "description": "\nF5 Product Development has evaluated the currently supported releases for potential vulnerability.\n\nTo determine if your release is known to be vulnerable, the components or features that are affected by the vulnerability, and for information about releases or hotfixes that address the vulnerability, refer to the following table:\n\nProduct| Versions known to be vulnerable| Versions known to be not vulnerable| Severity| Vulnerable component or feature \n---|---|---|---|--- \nBIG-IP LTM| None| 12.0.0 - 12.1.0 \n11.4.0 - 11.6.1 \n11.2.1 \n10.2.1 - 10.2.4| Not vulnerable| None \nBIG-IP AAM| None| 12.0.0 - 12.1.0 \n11.4.0 - 11.6.1| Not vulnerable| None \nBIG-IP AFM| None| 12.0.0 - 12.1.0 \n11.4.0 - 11.6.1| Not vulnerable| None \nBIG-IP Analytics| None| 12.0.0 - 12.1.0 \n11.4.0 - 11.6.1 \n11.2.1| Not vulnerable| None \nBIG-IP APM| None| 12.0.0 - 12.1.0 \n11.4.0 - 11.6.1 \n11.2.1 \n10.2.1 - 10.2.4| Not vulnerable| None \nBIG-IP ASM| None| 12.0.0 - 12.1.0 \n11.4.0 - 11.6.1 \n11.2.1 \n10.2.1 - 10.2.4| Not vulnerable| None \nBIG-IP DNS| None| 12.0.0 - 12.1.0| Not vulnerable| None \nBIG-IP Edge Gateway| None| 11.2.1 \n10.2.1 - 10.2.4| Not vulnerable| None \nBIG-IP GTM| None| 11.4.0 - 11.6.1 \n11.2.1 \n10.2.1 - 10.2.4| Not vulnerable| None \nBIG-IP Link Controller| None| 12.0.0 - 12.1.0 \n11.4.0 - 11.6.1 \n11.2.1 \n10.2.1 - 10.2.4| Not vulnerable| None \nBIG-IP PEM| None| 12.0.0 - 12.1.0 \n11.4.0 - 11.6.1| Not vulnerable| None \nBIG-IP PSM| None| 11.4.0 - 11.4.1 \n10.2.1 - 10.2.4| Not vulnerable| None \nBIG-IP WebAccelerator| None| 11.2.1 \n10.2.1 - 10.2.4| Not vulnerable| None \nBIG-IP WOM| None| 11.2.1 \n10.2.1 - 10.2.4| Not vulnerable| None \nARX| None| 6.2.0 - 6.4.0| Not vulnerable| None \nEnterprise Manager| None| 3.1.1| Not vulnerable| None \nFirePass| None| 7.0.0| Not vulnerable| None \nBIG-IQ Cloud| None| 4.0.0 - 4.5.0| Not vulnerable| None \nBIG-IQ Device| None| 4.2.0 - 4.5.0| Not vulnerable| None \nBIG-IQ Security| None| 4.0.0 - 4.5.0| Not vulnerable| None \nBIG-IQ ADC| None| 4.5.0| Not vulnerable| None \nBIG-IQ Centralized Management| None| 5.0.0 \n4.6.0| Not vulnerable| None \nBIG-IQ Cloud and Orchestration| None| 1.0.0| Not vulnerable| None \nF5 iWorkflow| None| 2.0.0| Not vulnerable| None \nLineRate| None| 2.5.0 - 2.6.1| Not vulnerable| None \nF5 MobileSafe| None| 1.0.0| Not vulnerable| None \nF5 WebSafe| None| 1.0.0| Not vulnerable| None \nTraffix SDC| None| 5.0.0 \n4.0.0 - 4.4.0| Not vulnerable| None\n\nNone\n\n * [K9970: Subscribing to email notifications regarding F5 products](<https://support.f5.com/csp/article/K9970>)\n * [K9957: Creating a custom RSS feed to view new and updated documents](<https://support.f5.com/csp/article/K9957>)\n * [K4602: Overview of the F5 security vulnerability response policy](<https://support.f5.com/csp/article/K4602>)\n * [K4918: Overview of the F5 critical issue hotfix policy](<https://support.f5.com/csp/article/K4918>)\n", "published": "2016-08-10T20:24:00", "cvss": {"score": 7.5, "vector": "AV:NETWORK/AC:LOW/Au:NONE/C:PARTIAL/I:PARTIAL/A:PARTIAL/"}, "href": "https://support.f5.com/csp/article/K55248799", "cvelist": ["CVE-2009-4427", "CVE-2005-2793", "CVE-2005-2792", "CVE-2005-2654", "CVE-2006-2016"], "lastseen": "2017-06-08T00:16:30"}, {"id": "SOL55248799", "type": "f5", "title": "SOL55248799 - phpLDAPAdmin vulnerabilities CVE-2005-2654, CVE-2005-2792, CVE-2005-2793, CVE-2006-2016, and CVE-2009-4427", "description": "Vulnerability Recommended Actions\n\nNone\n\nSupplemental Information\n\n * SOL9970: Subscribing to email notifications regarding F5 products\n * SOL9957: Creating a custom RSS feed to view new and updated documents\n * SOL4602: Overview of the F5 security vulnerability response policy\n * SOL4918: Overview of the F5 critical issue hotfix policy\n", "published": "2016-08-10T00:00:00", "cvss": {"score": 7.5, "vector": "AV:NETWORK/AC:LOW/Au:NONE/C:PARTIAL/I:PARTIAL/A:PARTIAL/"}, "href": "http://support.f5.com/kb/en-us/solutions/public/k/55/sol55248799.html", "cvelist": ["CVE-2009-4427", "CVE-2005-2793", "CVE-2005-2792", "CVE-2005-2654", "CVE-2006-2016"], "lastseen": "2016-09-26T17:22:55"}], "debian": [{"id": "DSA-790", "type": "debian", "title": "phpldapadmin -- programming error", "description": "Alexander Gerasiov discovered that phpldapadmin, a web based interface for administering LDAP servers, allows anybody to access the LDAP server anonymously, even if this is disabled in the configuration with the \"disable_anon_bind\" statement.\n\nThe old stable distribution (woody) is not vulnerable to this problem.\n\nFor the stable distribution (sarge) this problem has been fixed in version 0.9.5-3sarge2.\n\nFor the unstable distribution (sid) this problem has been fixed in version 0.9.6c-5.\n\nWe recommend that you upgrade your phpldapadmin package.", "published": "2005-08-30T00:00:00", "cvss": {"score": 7.5, "vector": "AV:NETWORK/AC:LOW/Au:NONE/C:PARTIAL/I:PARTIAL/A:PARTIAL/"}, "href": "http://www.debian.org/security/dsa-790", "cvelist": ["CVE-2005-2654"], "lastseen": "2016-09-02T18:29:03"}], "openvas": [{"id": "OPENVAS:55227", "type": "openvas", "title": "Gentoo Security Advisory GLSA 200509-04 (phpLDAPadmin)", "description": "The remote host is missing updates announced in\nadvisory GLSA 200509-04.", "published": "2008-09-24T00:00:00", "cvss": {"score": 7.5, "vector": "AV:NETWORK/AC:LOW/Au:NONE/C:PARTIAL/I:PARTIAL/A:PARTIAL/"}, "href": "http://plugins.openvas.org/nasl.php?oid=55227", "cvelist": ["CVE-2005-2654"], "lastseen": "2017-07-24T12:49:58"}, {"id": "OPENVAS:55192", "type": "openvas", "title": "Debian Security Advisory DSA 790-1 (phpldapadmin)", "description": "The remote host is missing an update to phpldapadmin\nannounced via advisory DSA 790-1.\n\nAlexander Gerasiov discovered that phpldapadmin, a web based interface\nfor administering LDAP servers, allows anybody to access the LDAP\nserver anonymously, even if this is disabled in the configuration with\nthe disable_anon_bind statement.\n\nThe old stable distribution (woody) is not vulnerable to this problem.", "published": "2008-01-17T00:00:00", "cvss": {"score": 7.5, "vector": "AV:NETWORK/AC:LOW/Au:NONE/C:PARTIAL/I:PARTIAL/A:PARTIAL/"}, "href": "http://plugins.openvas.org/nasl.php?oid=55192", "cvelist": ["CVE-2005-2654"], "lastseen": "2017-07-24T12:49:51"}], "gentoo": [{"id": "GLSA-200509-04", "type": "gentoo", "title": "phpLDAPadmin: Authentication bypass", "description": "### Background\n\nphpLDAPadmin is a web-based LDAP client allowing to easily manage LDAP servers. \n\n### Description\n\nAlexander Gerasiov discovered a flaw in login.php preventing the application from validating whether anonymous bind has been disabled in the target LDAP server configuration. \n\n### Impact\n\nAnonymous users can access the LDAP server, even if the \"disable_anon_bind\" parameter was explicitly set to avoid this. \n\n### Workaround\n\nThere is no known workaround at this time. \n\n### Resolution\n\nAll phpLDAPadmin users should upgrade to the latest version: \n \n \n # emerge --sync\n # emerge --ask --oneshot --verbose \">=net-nds/phpldapadmin-0.9.7_alpha6\"", "published": "2005-09-06T00:00:00", "cvss": {"score": 7.5, "vector": "AV:NETWORK/AC:LOW/Au:NONE/C:PARTIAL/I:PARTIAL/A:PARTIAL/"}, "href": "https://security.gentoo.org/glsa/200509-04", "cvelist": ["CVE-2005-2654"], "lastseen": "2016-09-06T19:46:40"}], "nessus": [{"id": "GENTOO_GLSA-200509-04.NASL", "type": "nessus", "title": "GLSA-200509-04 : phpLDAPadmin: Authentication bypass", "description": "The remote host is affected by the vulnerability described in GLSA-200509-04 (phpLDAPadmin: Authentication bypass)\n\n Alexander Gerasiov discovered a flaw in login.php preventing the application from validating whether anonymous bind has been disabled in the target LDAP server configuration.\n Impact :\n\n Anonymous users can access the LDAP server, even if the 'disable_anon_bind' parameter was explicitly set to avoid this.\n Workaround :\n\n There is no known workaround at this time.", "published": "2005-09-12T00:00:00", "cvss": {"score": 7.5, "vector": "AV:NETWORK/AC:LOW/Au:NONE/C:PARTIAL/I:PARTIAL/A:PARTIAL/"}, "href": "https://www.tenable.com/plugins/index.php?view=single&id=19669", "cvelist": ["CVE-2005-2654"], "lastseen": "2017-10-29T13:42:08"}, {"id": "DEBIAN_DSA-790.NASL", "type": "nessus", "title": "Debian DSA-790-1 : phpldapadmin - programming error", "description": "Alexander Gerasiov discovered that phpldapadmin, a web-based interface for administering LDAP servers, allows anybody to access the LDAP server anonymously, even if this is disabled in the configuration with the 'disable_anon_bind' statement.\n\nThe old stable distribution (woody) is not vulnerable to this problem.", "published": "2005-09-06T00:00:00", "cvss": {"score": 7.5, "vector": "AV:NETWORK/AC:LOW/Au:NONE/C:PARTIAL/I:PARTIAL/A:PARTIAL/"}, "href": "https://www.tenable.com/plugins/index.php?view=single&id=19560", "cvelist": ["CVE-2005-2654"], "lastseen": "2017-10-29T13:38:32"}, {"id": "PHPLDAPADMIN_DISABLE_ANON_BIND_BYPASS.NASL", "type": "nessus", "title": "phpLDAPadmin Anonymous Bind Security Bypass Vulnerability", "description": "The remote host is running phpLDAPadmin, a PHP-based LDAP browser. \n\nThe version of phpLDAPadmin installed on the remote host may allow access to an LDAP server anonymously, even if anonymous binds have been disabled in the application's configuration.", "published": "2005-08-31T00:00:00", "cvss": {"score": 7.5, "vector": "AV:NETWORK/AC:LOW/Au:NONE/C:PARTIAL/I:PARTIAL/A:PARTIAL/"}, "href": "https://www.tenable.com/plugins/index.php?view=single&id=19546", "cvelist": ["CVE-2005-2654"], "lastseen": "2017-10-29T13:37:46"}], "osvdb": [{"id": "OSVDB:19067", "type": "osvdb", "title": "phpLDAPadmin Unspecified Anonymous Bind Policy Bypass", "description": "# No description provided by the source\n\n## References:\n[Vendor Specific Advisory URL](http://www.debian.org/security/2005/dsa-790)\n[Secunia Advisory ID:16611](https://secuniaresearch.flexerasoftware.com/advisories/16611/)\n[Secunia Advisory ID:16636](https://secuniaresearch.flexerasoftware.com/advisories/16636/)\n[Secunia Advisory ID:16702](https://secuniaresearch.flexerasoftware.com/advisories/16702/)\nOther Advisory URL: http://www.gentoo.org/security/en/glsa/glsa-200509-04.xml\n[CVE-2005-2654](https://vulners.com/cve/CVE-2005-2654)\n", "published": "2005-08-30T06:15:04", "cvss": {"score": 7.5, "vector": "AV:NETWORK/AC:LOW/Au:NONE/C:PARTIAL/I:PARTIAL/A:PARTIAL/"}, "href": "https://vulners.com/osvdb/OSVDB:19067", "cvelist": ["CVE-2005-2654"], "lastseen": "2017-04-28T13:20:15"}]}}