CVE-2005-2069
Published Jun 30, 2005
Last updated 4 years ago
Overview
- Description
- pam_ldap and nss_ldap, when used with OpenLDAP and connecting to a slave using TLS, does not use TLS for the subsequent connection if the client is referred to a master, which may cause a password to be sent in cleartext and allows remote attackers to sniff the password.
- Source
- secalert@redhat.com
- NVD status
- Analyzed
Social media
- Hype score
- Not currently trending
Risk scores
CVSS 2.0
- Type
- Primary
- Base score
- 5
- Impact score
- 2.9
- Exploitability score
- 10
- Vector string
- AV:N/AC:L/Au:N/C:P/I:N/A:N
Weaknesses
- nvd@nist.gov
- CWE-319
Vendor comments
- Red HatRed Hat Enterprise Linux 5 is not vulnerable to this issue as it contains a backported patch.
Configurations
[
{
"nodes": [
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:a:padl:nss_ldap:-:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "558C8B99-55C2-42AE-9959-07A6944DA926"
},
{
"criteria": "cpe:2.3:a:padl:pam_ldap:-:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "21C67252-5F59-48D2-9569-E616BFAAA607"
}
],
"operator": "OR"
},
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:a:openldap:openldap:*:*:*:*:*:*:*:*",
"vulnerable": false,
"matchCriteriaId": "FF6CF2B3-671F-425B-8F2A-20E909249C84"
}
],
"operator": "OR"
}
],
"operator": "AND"
}
]