Nom du paquet
pam_ldap
Date
2006-11-07
Advisory ID
MDKSA-2006:201
Affected versions
2006.0 i586 , 2007.0 x86_64 , 2007.0 i586 , CS4.0 i586 , CS4.0 x86_64 , 2006.0 x86_64

Problem description

Pam_ldap does not return an error condition when an LDAP directory
server responds with a PasswordPolicyResponse control response, which
causes the pam_authenticate function to return a success code even if
authentication has failed, as originally reported for xscreensaver.
This might lead to an attacker being able to login into a suspended
system account.

Updated packages have been patched to correct this issue.

Updated packages

2006.0 i586

 88544f487e0884831e8dca48d9420eca  2006.0/i586/pam_ldap-180-2.1.20060mdk.i586.rpm 
 2873ac0db22512131ad2f4a5d055e035  2006.0/SRPMS/pam_ldap-180-2.1.20060mdk.src.rpm

2007.0 x86_64

 079964ab75deaa3a8d723bc63c4e9be7  2007.0/x86_64/pam_ldap-180-4.1mdv2007.0.x86_64.rpm 
 3a747dcc317e95fdc9011c1dfc4254ef  2007.0/SRPMS/pam_ldap-180-4.1mdv2007.0.src.rpm

2007.0 i586

 338ecc4e0b69209b99f9ad317d6d2385  2007.0/i586/pam_ldap-180-4.1mdv2007.0.i586.rpm 
 3a747dcc317e95fdc9011c1dfc4254ef  2007.0/SRPMS/pam_ldap-180-4.1mdv2007.0.src.rpm

CS4.0 i586

 8e800885b38df7d3b566cea4934cdb24  corporate/4.0/i586/pam_ldap-180-3.1.20060mlcs4.i586.rpm 
 4abf9cd7b032153e407cf487968bc10a  corporate/4.0/SRPMS/pam_ldap-180-3.1.20060mlcs4.src.rpm

CS4.0 x86_64

 92a60cc8a2d16e7cb305a7665e39e696  corporate/4.0/x86_64/pam_ldap-180-3.1.20060mlcs4.x86_64.rpm 
 4abf9cd7b032153e407cf487968bc10a  corporate/4.0/SRPMS/pam_ldap-180-3.1.20060mlcs4.src.rpm

2006.0 x86_64

 4cdb139a35c0b877fccb62b344292133  2006.0/x86_64/pam_ldap-180-2.1.20060mdk.x86_64.rpm 
 2873ac0db22512131ad2f4a5d055e035  2006.0/SRPMS/pam_ldap-180-2.1.20060mdk.src.rpm

References