Caldera Volution Manager Default Cleartext Directory Administrator Password Vulnerability
BID:4923
Info
Caldera Volution Manager Default Cleartext Directory Administrator Password Vulnerability
| Bugtraq ID: | 4923 |
| Class: | Configuration Error |
| CVE: | |
| Remote: | No |
| Local: | Yes |
| Published: | Jun 03 2002 12:00AM |
| Updated: | Jun 03 2002 12:00AM |
| Credit: | Announced in Caldera security advisory CSSA-2002-024.0. |
| Vulnerable: |
Caldera Volution Manager 1.1 |
| Not Vulnerable: | |
Discussion
Caldera Volution Manager Default Cleartext Directory Administrator Password Vulnerability
Caldera has reported that Volution Manager 1.1 stores the Directory Administrator password in cleartext in the '/etc/ldap/sldap.conf' configuration file. While Volution Manager supports encrypted passwords, they are not enabled by default.
It should be noted that '/etc/ldap/sldap.conf' is not world-readable. The attacker may exploit another vulnerability to obtain the file contents.
Caldera has reported that Volution Manager 1.1 stores the Directory Administrator password in cleartext in the '/etc/ldap/sldap.conf' configuration file. While Volution Manager supports encrypted passwords, they are not enabled by default.
It should be noted that '/etc/ldap/sldap.conf' is not world-readable. The attacker may exploit another vulnerability to obtain the file contents.
Exploit / POC
Caldera Volution Manager Default Cleartext Directory Administrator Password Vulnerability
There is no exploit required.
There is no exploit required.
Solution / Fix
Caldera Volution Manager Default Cleartext Directory Administrator Password Vulnerability
Solution:
Caldera has reported that the default configuration will be changed in the next revision. To implement the encryption feature, Caldera advises the following (from advisory CSSA-2002-024.0):
As the root user, run slappasswd, entering your desired
password at the prompts (the example uses newpasswd as the new
password; the password will not be seen as you type it).
# slappasswd
New password: newpasswd
Re-enter new password: newpasswd
{SSHA}AvcGnFPjUCqbIs/Ki8XfiOYJwttfwnRz
#
The output is the new, encrypted password. In the file
/etc/ldap/slapd.conf, replace the previous rootpw line with a
line containing the new, encrypted password so that the line
looks similar to this:
rootpw {SSHA}AvcGnFPjUCqbIs/Ki8XfiOYJwttfwnRz
Solution:
Caldera has reported that the default configuration will be changed in the next revision. To implement the encryption feature, Caldera advises the following (from advisory CSSA-2002-024.0):
As the root user, run slappasswd, entering your desired
password at the prompts (the example uses newpasswd as the new
password; the password will not be seen as you type it).
# slappasswd
New password: newpasswd
Re-enter new password: newpasswd
{SSHA}AvcGnFPjUCqbIs/Ki8XfiOYJwttfwnRz
#
The output is the new, encrypted password. In the file
/etc/ldap/slapd.conf, replace the previous rootpw line with a
line containing the new, encrypted password so that the line
looks similar to this:
rootpw {SSHA}AvcGnFPjUCqbIs/Ki8XfiOYJwttfwnRz