IBM Tivoli Directory Server 'LDAP_ADD' Information Disclosure Vulnerability

Bugtraq ID:	47581
Class:	Design Error
CVE:	CVE-2011-1822
Remote:	No
Local:	Yes
Published:	Apr 12 2011 12:00AM
Updated:	Apr 12 2011 12:00AM
Credit:	Reported by the vendor.
Vulnerable:	IBM Tivoli Directory Server 5.2.0.5
Not Vulnerable:	IBM Tivoli Directory Server 5.2 5-TIV-ITDS-IF0010 IBM Tivoli Directory Server 5.2 5-TIV-ITDS-IF0009

IBM Tivoli Directory Server 'LDAP_ADD' Information Disclosure Vulnerability

IBM Tivoli Directory Server is prone to an information-disclosure vulnerability.

Successful exploits will allow attackers to obtain sensitive information that may aid in further attacks.

IBM Tivoli Directory Server version 5.2 before 5.2.0.5-TIV-ITDS-IF0009 are vulnerable.

IBM Tivoli Directory Server 'LDAP_ADD' Information Disclosure Vulnerability

Solution:
Updates are available for this issue. Please see the references for details.

IBM Tivoli Directory Server 'LDAP_ADD' Information Disclosure Vulnerability

References:

• IO11882: IDS 5.2 change log of LDAP_ADD stores SHA password in clear text (IBM)
  
• Tivoli Directory Server Homepage (IBM)
  
• Tivoli Directory Server, Version 5.2.0.5-TIV-ITDS-IF0010 (IBM)