Fedora Directory Server Password Information Disclosure Vulnerability

Bugtraq ID:	16729
Class:	Access Validation Error
CVE:	CVE-2005-3630
Remote:	Yes
Local:	No
Published:	Feb 20 2006 12:00AM
Updated:	Feb 22 2006 04:42PM
Credit:	The vendor disclosed this vulnerability.
Vulnerable:	Redhat Fedora Directory Server 1.0
Not Vulnerable:	Redhat Fedora Directory Server 1.0.1

Fedora Directory Server Password Information Disclosure Vulnerability

Fedora Directory Server is prone to an information-disclosure vulnerability. This issue is due to a failure in the application to do proper access validation before granting access to sensitive and privileged information.


An attacker can exploit this vulnerability to obtain escalated privileges within the context of the server application. Information obtained may aid in further attacks against the underlying system; other attacks are also possible.

Fedora Directory Server Password Information Disclosure Vulnerability

No exploit is required.

Fedora Directory Server Password Information Disclosure Vulnerability

Solution:

The vendor has addressed this issue by releasing version 1.0.1. Please see the references for further details.


Redhat Fedora Directory Server 1.0

• RedHat Fedora fedora-ds-1.0.1.tar.gz
  http://directory.fedora.redhat.com/sources/fedora-ds-1.0.1.tar.gz

Fedora Directory Server Password Information Disclosure Vulnerability

References:

• Bugzilla Bug 174837 �?? CVE-2005-3630 use of IFRAME exposes password from adm.conf (Redhat)
  
• Fedora Directory Server Web Page (Fedora)