CVE-2005-2069

pamldap and nssldap, when used with OpenLDAP and connecting to a slave using TLS, does not use TLS for the subsequent connection if the client is referred to a master, which may cause a password to be sent in cleartext and allows remote attackers to sniff the password...

CVE-2005-2069

The CVE concerns pam_ldap/nss_ldap used with OpenLDAP when the client is referred from a TLS-secured slave to a master; the following connection may not use TLS, allowing passwords to be sniffed. Connected advisories (e.g., Debian DSA-785-1) reference CVE-2005-2069 (and related CVEs) and note upd...

CVE-2005-2069

Removed by vendor...

shtool insecure temporary file creation

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 shtool insecure temporary file creation Vendor: http://www.gnu.org/software/shtool/ Advisory: http://www.zataz.net/adviso/shtool-05252005.txt Vendor informed: no more vendor Exploit available: yes Impact : low Exploitation : low shtool contain a...

CVE-2003-1201

OpenLDAP prior to 2.1.13 is affected by a denial-of-service vulnerability in the back-ldbm backend. Specifically, ldbm_back_exop_passwd frees an uninitialized pointer when slap_passwd_parse does not return LDAP_SUCCESS, potentially causing a segmentation fault on remote attack. Affected versions ...

CVE-2004-1880

Memory leak in the back-bdb backend for OpenLDAP 2.1.12 and earlier allows remote attackers to cause a denial of service memory consumption...

CVE-2004-1997

CVE-2004-1997 : Kolab stores OpenLDAP passwords in plaintext in the slapd.conf file, which may be world-readable and allow local users to gain privileges. The NVD entry lists a CVSSv2 base score of 4.6 (LOCAL access, LOW attack complexity, PARTIAL confidentiality/integrity/availability impacts). ...

CVE-2004-1880

Technical details about CVE-2004-1880 are not provided in the connected documents. The available entries reiterate the memory leak in OpenLDAP’s back-bdb backend for 2.1.12 and earlier. Monitor for updates.

CVE-2003-1201

ldbmbackexoppasswd in the back-ldbm backend in passwd.c for OpenLDAP 2.1.12 and earlier, when the slappasswdparse function does not return LDAPSUCCESS, attempts to free an uninitialized pointer, which allows remote attackers to cause a denial of service segmentation fault...

CVE-2004-1997

Kolab stores OpenLDAP passwords in plaintext in the slapd.conf file, which may be installed world-readable, which allows local users to gain privileges...

CVE-2004-0823

OpenLDAP vulnerabilities: CVE-2004-0823 affects OpenLDAP 1.0–2.1.19 (as used in macOS 10.3.x and potentially other OSes). The issue allows certain authentication schemes to treat hashed (crypt) passwords stored in the userPassword attribute as plaintext, enabling remote attackers to reuse hashed ...

CVE-2004-0823

OpenLDAP 1.0 through 2.1.19, as used in Apple Mac OS 10.3.4 and 10.3.5 and possibly other operating systems, may allow certain authentication schemes to use hashed crypt passwords in the userPassword attribute as if they were plaintext passwords, which allows remote attackers to re-use hashed...

CVE-2004-1880

Memory leak in the back-bdb backend for OpenLDAP 2.1.12 and earlier allows remote attackers to cause a denial of service memory consumption...

Debian DSA-068-1 : openldap - remote DoS

The CERT advisory lists a number of vulnerabilities in various LDAP implementations, based on the results of the PROTOS LDAPv3 test suite. These tests found one problem in OpenLDAP, a free LDAP implementation which is shipped as part of Debian GNU/Linux 2.2. The problem is that slapd did not hand...

Mac OS X Multiple Vulnerabilities (Security Update 2004-09-07)

The remote host is missing Security Update 2004-09-07. This security update fixes the following components : - CoreFoundation - IPSec - Kerberos - libpcap - lukemftpd - NetworkConfig - OpenLDAP - OpenSSH - PPPDialer - rsync - Safari - tcpdump These applications contain multiple vulnerabilities th...

CVE-2004-0823

OpenLDAP 1.0 through 2.1.19, as used in Apple Mac OS 10.3.4 and 10.3.5 and possibly other operating systems, may allow certain authentication schemes to use hashed crypt passwords in the userPassword attribute as if they were plaintext passwords, which allows remote attackers to re-use hashed...

CVE-2000-0747

The CVE-2000-0747 entry concerns OpenLDAP prior to version 1.2.11 on Conectiva Linux. The issue arises from the logrotate script sending an improper signal to the kernel log daemon (klogd), which results in klogd being killed. The available records describe the vulnerable component as the logrota...

CVE-2000-0747

The logrotate script for OpenLDAP before 1.2.11 in Conectiva Linux sends an improper signal to the kernel log daemon klogd and kills it...

GLSA-200403-12 : OpenLDAP DoS Vulnerability

The remote host is affected by the vulnerability described in GLSA-200403-12 OpenLDAP DoS Vulnerability A password extended operation password EXOP which fails will cause the slapd server to free an uninitialized pointer, possibly resulting in a segfault. This only affects servers using the...

Mandrake Linux Security Advisory : openldap (MDKSA-2001:069)

CERT released an advisory that details a number of vulnerabilities as found in a variety of different LDAP implementations. The results of these tests showed one vulnerability in OpenLDAP with slapd not handling packets with certain invalid fields. A malicious attacker could craft such invalid...