K5716 : Authentication bypass in PAM LDAP module - CAN-2005-2641

Security Advisory Description

Note: Versions that are not listed in this article have not been evaluated for vulnerability to this security advisory. For information about the F5 security policy regarding evaluating older and unsupported versions of F5 products, refer to K4602: Overview of the F5 security vulnerability response policy.

F5 products and versions that have been evaluated for this Security Advisory

Vulnerability in pam_ldap before 180 does not properly handle a new password policy control, which could allow attackers to gain privileges.

Information about this advisory is available at the following locations:

• US-CERT Vulnerability Note VU#778916 pam_ldap authentication bypass vulnerability:
  <http://www.kb.cert.org/vuls/id/778916&gt;
• CAN-2005-2641- pam_ldap does not properly handle a new password policy control:
  <http://cve.mitre.org/cgi-bin/cvename.cgi?name=2005-2641&gt;
• JP Vendor Status Notes JVNVU#778916:
  <http://jvn.jp/cert/JVNVU%23778916/&gt;