OpenLDAP Ambiguous Password Attribute Weakness

BID:11137

Info

OpenLDAP Ambiguous Password Attribute Weakness

Bugtraq ID: 11137
Class: Design Error
CVE: CVE-2004-0823
Remote: Yes
Local: No
Published: Sep 07 2004 12:00AM
Updated: Aug 16 2006 09:45PM
Credit: Steve Revilak of Kayak Software Corporation disclosed this weakness.
Vulnerable: OpenLDAP OpenLDAP 2.1.19
OpenLDAP OpenLDAP 2.1.18
OpenLDAP OpenLDAP 2.1.17
OpenLDAP OpenLDAP 2.1.16
OpenLDAP OpenLDAP 2.1.15
OpenLDAP OpenLDAP 2.1.14
OpenLDAP OpenLDAP 2.1.13
OpenLDAP OpenLDAP 2.1.12
+ S.u.S.E. Linux Personal 8.2
OpenLDAP OpenLDAP 2.1.11
OpenLDAP OpenLDAP 2.1.10
OpenLDAP OpenLDAP 2.1.4
+ Conectiva Linux Enterprise Edition 1.0
OpenLDAP OpenLDAP 2.1 .20
OpenLDAP OpenLDAP 2.0.27
OpenLDAP OpenLDAP 2.0.25
+ Gentoo Linux 1.4 _rc1
 + Gentoo Linux 1.4 _rc1
 + Gentoo Linux 1.2
+ Gentoo Linux 1.2
+ Mandriva Linux Mandrake 9.0
+ Redhat Linux 8.0 i386
 + Redhat Linux 8.0 i386
 + Redhat Linux 8.0
+ Redhat Linux 8.0
OpenLDAP OpenLDAP 2.0.23
+ Debian Linux 3.0 sparc
 + Debian Linux 3.0 s/390
 + Debian Linux 3.0 s/390
 + Debian Linux 3.0 ppc
 + Debian Linux 3.0 ppc
 + Debian Linux 3.0 mipsel
 + Debian Linux 3.0 mipsel
 + Debian Linux 3.0 mips
 + Debian Linux 3.0 mips
 + Debian Linux 3.0 m68k
 + Debian Linux 3.0 m68k
 + Debian Linux 3.0 ia-64
 + Debian Linux 3.0 ia-64
 + Debian Linux 3.0 ia-32
 + Debian Linux 3.0 ia-32
 + Debian Linux 3.0 hppa
 + Debian Linux 3.0 hppa
 + Debian Linux 3.0 arm
 + Debian Linux 3.0 arm
 + Debian Linux 3.0 alpha
 + Debian Linux 3.0 alpha
 + Debian Linux 3.0
+ Debian Linux 3.0
+ Redhat Linux 7.3 i386
 + Redhat Linux 7.3 i386
 + Redhat Linux 7.3
+ Redhat Linux 7.3
+ SuSE Linux 8.0
+ SuSE Linux 8.0
OpenLDAP OpenLDAP 2.0.22
OpenLDAP OpenLDAP 2.0.21
+ Mandriva Linux Mandrake 8.2 ppc
 + Mandriva Linux Mandrake 8.2
+ Mandriva Linux Mandrake 8.2
OpenLDAP OpenLDAP 2.0.20
OpenLDAP OpenLDAP 2.0.19
OpenLDAP OpenLDAP 2.0.18
OpenLDAP OpenLDAP 2.0.17
OpenLDAP OpenLDAP 2.0.16
OpenLDAP OpenLDAP 2.0.15
OpenLDAP OpenLDAP 2.0.14
+ Mandriva Linux Mandrake 8.1 ia64
 + Mandriva Linux Mandrake 8.1
+ Mandriva Linux Mandrake 8.1
+ Mandriva Linux Mandrake 8.0 ppc
 + Mandriva Linux Mandrake 8.0
OpenLDAP OpenLDAP 2.0.13
OpenLDAP OpenLDAP 2.0.12
+ SuSE Linux 7.3 sparc
 + SuSE Linux 7.3 sparc
 + SuSE Linux 7.3 ppc
 + SuSE Linux 7.3
+ SuSE Linux 7.3
OpenLDAP OpenLDAP 2.0.11 -9
+ Caldera OpenLinux Server 3.1.1
+ Caldera OpenLinux Server 3.1.1
+ Caldera OpenLinux Workstation 3.1.1
OpenLDAP OpenLDAP 2.0.11 -11S
- Caldera OpenLinux eBuilder 3.0
- Caldera OpenLinux eBuilder 3.0
- SCO eServer 2.3.1
OpenLDAP OpenLDAP 2.0.11 -11
- Caldera OpenLinux 3.1 -IA64
 - Caldera OpenLinux Server 3.1.1
- Caldera OpenLinux Server 3.1.1
- Caldera OpenLinux Server 3.1
- Caldera OpenLinux Server 3.1
- Caldera OpenLinux Workstation 3.1.1
- Caldera OpenLinux Workstation 3.1.1
- Caldera OpenLinux Workstation 3.1
- Caldera OpenLinux Workstation 3.1
OpenLDAP OpenLDAP 2.0.11
+ Caldera OpenLinux Server 3.1.1
+ Caldera OpenLinux Server 3.1.1
+ Caldera OpenLinux Workstation 3.1.1
+ HP Secure OS software for Linux 1.0
+ HP Secure OS software for Linux 1.0
+ Redhat Linux 7.2 ia64
 + Redhat Linux 7.2 ia64
 + Redhat Linux 7.2 i386
 + Redhat Linux 7.2 i386
 + Redhat Linux 7.2 alpha
 + Redhat Linux 7.2 alpha
 + Redhat Linux 7.2
+ Redhat Linux 7.2
+ Redhat Linux 7.1 ia64
 + Redhat Linux 7.1 i386
 + Redhat Linux 7.1
+ SuSE Linux 7.2
+ SuSE Linux 7.2
+ SuSE Linux 7.1 sparc
 + SuSE Linux 7.1 sparc
 + SuSE Linux 7.1 ppc
 + SuSE Linux 7.1 ppc
 + SuSE Linux 7.1 alpha
 + SuSE Linux 7.1 alpha
 + SuSE Linux 7.1
+ SuSE Linux 7.1
OpenLDAP OpenLDAP 2.0.10
OpenLDAP OpenLDAP 2.0.9
OpenLDAP OpenLDAP 2.0.8
OpenLDAP OpenLDAP 2.0.7
+ Caldera OpenLinux 3.1 -IA64
 + Caldera OpenLinux eBuilder 3.0
+ Caldera OpenLinux eBuilder 3.0
+ Caldera OpenLinux Server 3.1
+ Caldera OpenLinux Server 3.1
+ Caldera OpenLinux Workstation 3.1
+ Caldera OpenLinux Workstation 3.1
+ HP Secure OS software for Linux 1.0
+ HP Secure OS software for Linux 1.0
+ Mandriva Linux Mandrake 8.0 ppc
 + Mandriva Linux Mandrake 8.0 ppc
 + Mandriva Linux Mandrake 8.0
+ Mandriva Linux Mandrake 8.0
+ Redhat Linux 7.1 ia64
 + Redhat Linux 7.1 ia64
 + Redhat Linux 7.1 i386
 + Redhat Linux 7.1 i386
 + Redhat Linux 7.1 alpha
 + Redhat Linux 7.1 alpha
 + Redhat Linux 7.1
+ Redhat Linux 7.1
+ SCO eServer 2.3.1
+ SCO eServer 2.3.1
OpenLDAP OpenLDAP 2.0.6
OpenLDAP OpenLDAP 2.0.5
OpenLDAP OpenLDAP 2.0.4
OpenLDAP OpenLDAP 2.0.3
OpenLDAP OpenLDAP 2.0.2
OpenLDAP OpenLDAP 2.0.1
OpenLDAP OpenLDAP 2.0
- Caldera OpenLinux eBuilder 3.0
- SCO eDesktop 2.4
- SCO eServer 2.3
OpenLDAP OpenLDAP 1.2.13
+ Trustix Secure Linux 1.5
+ Trustix Secure Linux 1.2
+ Trustix Secure Linux 1.2
+ Trustix Secure Linux 1.1
+ Trustix Secure Linux 1.1
OpenLDAP OpenLDAP 1.2.12
OpenLDAP OpenLDAP 1.2.11
- Debian Linux 2.2 sparc
 - Debian Linux 2.2 sparc
 - Debian Linux 2.2 powerpc
 - Debian Linux 2.2 powerpc
 - Debian Linux 2.2 arm
 - Debian Linux 2.2 arm
 - Debian Linux 2.2 alpha
 - Debian Linux 2.2 alpha
 - Debian Linux 2.2 68k
 - Debian Linux 2.2
- Debian Linux 2.2
+ Redhat Linux 7.0 i386
 + Redhat Linux 7.0 i386
 + Redhat Linux 7.0
+ Redhat Linux 7.0
OpenLDAP OpenLDAP 1.2.10
OpenLDAP OpenLDAP 1.2.9
+ Redhat Linux 6.2 i386
 + Redhat Linux 6.2 i386
 + Redhat Linux 6.2
 OpenLDAP OpenLDAP 1.2.8
OpenLDAP OpenLDAP 1.2.7
OpenLDAP OpenLDAP 1.2.6
OpenLDAP OpenLDAP 1.2.5
OpenLDAP OpenLDAP 1.2.4
OpenLDAP OpenLDAP 1.2.3
OpenLDAP OpenLDAP 1.2.2
OpenLDAP OpenLDAP 1.2.1
OpenLDAP OpenLDAP 1.2
OpenLDAP OpenLDAP 1.1.4
OpenLDAP OpenLDAP 1.1.3
OpenLDAP OpenLDAP 1.1.2
OpenLDAP OpenLDAP 1.1.1
OpenLDAP OpenLDAP 1.1
OpenLDAP OpenLDAP 1.0.3
OpenLDAP OpenLDAP 1.0.2
OpenLDAP OpenLDAP 1.0.1
OpenLDAP OpenLDAP 1.0
Avaya S8710 R2.0.1
Avaya S8710 R2.0.0
Avaya S8700 R2.0.1
Avaya S8700 R2.0.0
Avaya S8500 R2.0.1
Avaya S8500 R2.0.0
Avaya S8300 R2.0.1
Avaya S8300 R2.0.0
Avaya Messaging Storage Server
Avaya Message Networking
Avaya Intuity LX
Apple Mac OS X Server 10.3.5
Apple Mac OS X Server 10.3.4
Apple Mac OS X Server 10.2.8
Apple Mac OS X 10.3.5
Apple Mac OS X 10.3.4
Apple Mac OS X 10.2.8
Not Vulnerable:

Discussion

OpenLDAP Ambiguous Password Attribute Weakness

In certain undisclosed cases, OpenLDAP is reported prone to an ambiguous-password-attribute weakness.

If an attacker can retrieve a password hash as contained in the OpenLDAP database, they may then be able to directly authenticate to the LDAP database. The attacker may gain unauthorized access if they can sniff password hashes from the network or if they can retrieve the contents of the 'userPassword' attribute from a database backup or through weak permissions on the database.

The OpenLDAP that is included with Apple Mac OS X, versions 10.3.4 and 10.3.5, is reported affected. Versions of OpenLDAP included in other operating systems may also be affected.

Exploit / POC

OpenLDAP Ambiguous Password Attribute Weakness

An exploit is not required.

Solution / Fix

OpenLDAP Ambiguous Password Attribute Weakness

Solution:
Apple has released an advisory (APPLE-SA-0024-09-07) along with fixes to address this and many other issues. Please see the referenced advisory for more information.


Apple Mac OS X 10.2.8

Apple Mac OS X Server 10.2.8

Apple Mac OS X Server 10.3.4

Apple Mac OS X 10.3.4

Apple Mac OS X Server 10.3.5

Apple Mac OS X 10.3.5

References

OpenLDAP Ambiguous Password Attribute Weakness

References:

© CVE.report 2026

Use of this information constitutes acceptance for use in an AS IS condition. There are NO warranties, implied or otherwise, with regard to this information or its use. Any use of this information is at the user's risk. It is the responsibility of user to evaluate the accuracy, completeness or usefulness of any information, opinion, advice or other content. EACH USER WILL BE SOLELY RESPONSIBLE FOR ANY consequences of his or her direct or indirect use of this web site. ALL WARRANTIES OF ANY KIND ARE EXPRESSLY DISCLAIMED. This site will NOT BE LIABLE FOR ANY DIRECT, INDIRECT or any other kind of loss.

CVE, CWE, and OVAL are registred trademarks of The MITRE Corporation and the authoritative source of CVE content is MITRE's CVE web site. This site includes MITRE data granted under the following license.

Free CVE JSON API cve.report/api

CVE.report and Source URL Uptime Status status.cve.report