ldapscripts Local Command Line Information Disclosure Vulnerability

Bugtraq ID:	25982
Class:	Design Error
CVE:	CVE-2007-5373
Remote:	No
Local:	Yes
Published:	Oct 09 2007 12:00AM
Updated:	Mar 17 2008 05:50PM
Credit:	Don Armstrong <[email protected]> is credited with the discovery of this issue.
Vulnerable:	ldapscripts ldapscripts 1.7 ldapscripts ldapscripts 1.4 Debian Linux 4.0 sparc Debian Linux 4.0 s/390 Debian Linux 4.0 powerpc Debian Linux 4.0 mipsel Debian Linux 4.0 mips Debian Linux 4.0 m68k Debian Linux 4.0 ia-64 Debian Linux 4.0 ia-32 Debian Linux 4.0 hppa Debian Linux 4.0 arm Debian Linux 4.0 amd64 Debian Linux 4.0 alpha Debian Linux 4.0
Not Vulnerable:

ldapscripts Local Command Line Information Disclosure Vulnerability

The 'ldapscripts' package is prone to an information-disclosure vulnerability because of the way the software displays command-line data.

Attackers can leverage this issue to gain user account credentials. Successful attacks will compromise affected user accounts.

This issue affects ldapscripts 1.4 and 1.7; other versions may also be affected.

ldapscripts Local Command Line Information Disclosure Vulnerability

Currently we are not aware of any working exploits for this issue. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].

ldapscripts Local Command Line Information Disclosure Vulnerability

Solution:
Please see the referenced advisories for details on obtaining and applying the appropriate updates.

ldapscripts Local Command Line Information Disclosure Vulnerability

References:

• Debian Bug report logs - #445582 ldapscripts shows passwords in the clear on the (Debian)
  
• ldapscripts Project Page (ldapscripts)