CVE-2005-2069
Summary
| CVE | CVE-2005-2069 |
|---|
| State | PUBLIC |
|---|
| Assigner | [email protected] |
|---|
| Source Priority | CVE Program / NVD first with legacy fallback |
|---|
| Published | 2005-06-30 04:00:00 UTC |
|---|
| Updated | 2020-11-16 19:30:00 UTC |
|---|
| Description | pam_ldap and nss_ldap, when used with OpenLDAP and connecting to a slave using TLS, does not use TLS for the subsequent connection if the client is referred to a master, which may cause a password to be sent in cleartext and allows remote attackers to sniff the password. |
|---|
NVD Known Affected Configurations (CPE 2.3)
References
| Reference | Source | Link | Tags |
|---|
| 17692 |
OSVDB |
www.osvdb.org |
Broken Link |
| IBM X-Force Exchange |
XF |
exchange.xforce.ibmcloud.com |
Third Party Advisory, VDB Entry |
| Repository / Oval Repository |
OVAL |
oval.cisecurity.org |
Third Party Advisory |
| 20050704 pam_ldap/nss_ldap password leak in a master+slave+start_tls LDAP setup |
FULLDISC |
archives.neohapsis.com |
Broken Link |
| OpenLDAP ITS - Incoming/3791 |
MISC |
www.openldap.org |
Patch, Vendor Advisory |
| Gentoo Bug 96767 - sys-auth/{pam_ldap|nss_ldap} not using tls for referred connections |
CONFIRM |
bugs.gentoo.org |
Third Party Advisory |
| Secunia - Advisories - Red Hat update for openldap / nss_ldap |
SECUNIA |
secunia.com |
Third Party Advisory |
| OpenLDAP TLS Plaintext Password Vulnerability |
BID |
www.securityfocus.com |
Third Party Advisory, VDB Entry |
| Gentoo Linux Documentation
--
pam_ldap and nss_ldap: Plain text authentication leak |
GENTOO |
www.gentoo.org |
Third Party Advisory |
| Bug 210 - ssl start_tls not honoured when chasing referrals |
MISC |
bugzilla.padl.com |
Issue Tracking, Patch, Vendor Advisory |
| rhn.redhat.com | Red Hat Support |
REDHAT |
www.redhat.com |
Third Party Advisory |
| Fedora update for openldap - Secunia Advisories - Vulnerability Intelligence - Secunia.com |
SECUNIA |
secunia.com |
Third Party Advisory |
| usn/usn-152-1 - Ubuntu Linux |
UBUNTU |
www.ubuntu.com |
Third Party Advisory |
| bugzilla.padl.com/show_bug.cgi |
MISC |
bugzilla.padl.com |
Issue Tracking, Vendor Advisory |
| PADL Software PAM_LDAP TLS Plaintext Password Vulnerability |
BID |
www.securityfocus.com |
Third Party Advisory, VDB Entry |
| 161990 – openldap password disclosure issue |
CONFIRM |
bugzilla.redhat.com |
Issue Tracking, Third Party Advisory |
| Avaya Products Multiple Vulnerabilities - Advisories - Secunia |
SECUNIA |
secunia.com |
Third Party Advisory |
| ASA-2006-157 (RHSA-2005-751) |
CONFIRM |
support.avaya.com |
Third Party Advisory |
| Advisories - Mandriva |
MANDRIVA |
wwwnew.mandriva.com |
Third Party Advisory |
| rhn.redhat.com | Red Hat Support |
REDHAT |
www.redhat.com |
Third Party Advisory |
| CVE Program record |
CVE.ORG |
www.cve.org |
canonical |
| NVD vulnerability detail |
NVD |
nvd.nist.gov |
canonical, analysis |
Vendor Comments And Credit
| Organization | Published | Contributor | Statement |
|---|
| Red Hat | 2007-03-14 | Mark J Cox | Red Hat Enterprise Linux 5 is not vulnerable to this issue as it contains a backported patch. |
Legacy QID Mappings
- 900145 CBL-Mariner Linux Security Update for openldap 2.4.50
- 903296 Common Base Linux Mariner (CBL-Mariner) Security Update for openldap (2545)
