PAM/NSS LDAP vulnerabilitiy

2005-07-2100:00:00

ubuntu.com

5 Medium

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

NONE

Availability Impact

NONE

AV:N/AC:L/Au:N/C:P/I:N/A:N

5.9 Medium

AI Score

Confidence

Low

0.009 Low

EPSS

Percentile

82.8%

JSON

Releases

Ubuntu 5.04
Ubuntu 4.10

Details

Andrea Barisani discovered a flaw in the SSL handling of pam-ldap and
libnss-ldap. When a client connected to a consumer LDAP server using SSL,
the consumer server did not use SSL as well when contacting the LDAP
provider server. This caused passwords and other confident information
to be transmitted unencrypted between the consumer and the provider.

OSVersionArchitecturePackageVersionFilename
Ubuntu5.04noarchlibnss-ldap< *UNKNOWN
Ubuntu5.04noarchlibpam-ldap< *UNKNOWN
Ubuntu5.04noarchslapd< *UNKNOWN
Ubuntu4.10noarchlibnss-ldap< *UNKNOWN
Ubuntu4.10noarchlibpam-ldap< *UNKNOWN
Ubuntu4.10noarchslapd< *UNKNOWN

OS	Version	Architecture	Package	Version	Filename
Ubuntu	5.04	noarch	libnss-ldap	< *	UNKNOWN
Ubuntu	5.04	noarch	libpam-ldap	< *	UNKNOWN
Ubuntu	5.04	noarch	slapd	< *	UNKNOWN
Ubuntu	4.10	noarch	libnss-ldap	< *	UNKNOWN
Ubuntu	4.10	noarch	libpam-ldap	< *	UNKNOWN
Ubuntu	4.10	noarch	slapd	< *	UNKNOWN