pam_ldap: Authentication bypass vulnerability — GLSA 200612-19

pam_ldap contains a vulnerability that may allow a remote user with a locked account to gain unauthorized system access.

Affected packages

Package	sys-auth/pam_ldap on all architectures
Affected versions	< 183
Unaffected versions	>= 183

Background

pam_ldap is a Pluggable Authentication Module which allows authentication against LDAP directories.

Description

Steve Rigler discovered that pam_ldap does not correctly handle "PasswordPolicyResponse" control responses from an LDAP directory. This causes the pam_authenticate() function to always succeed, even if the previous authentication failed.

Impact

A locked user may exploit this vulnerability to bypass the LDAP authentication mechanism, possibly gaining unauthorized access to the system.

Workaround

There is no known workaround at this time.

Resolution

All pam_ldap users should upgrade to the latest version:

 # emerge --sync
 # emerge --ask --oneshot --verbose ">=sys-auth/pam_ldap-183"

References

CVE-2006-5170

Release date
December 20, 2006

Latest revision
December 20, 2006: 01

Severity
low

Exploitable
remote

Bugzilla entries

153916