Date: Thu, 05 Oct 2006 17:46:26 -0400
From: rPath Update Announcements <announce-noreply@rpath.com.>
To: [email protected],
Subject: rPSA-2006-0183-1 nss_ldap
Message-ID: <45257d32.nX3eZj6a/TBOxq3W%[email protected]>
User-Agent: nail 11.22 3/20/05
MIME-Version: 1.0
Content-Type: text/plain; charset=us-ascii
Content-Transfer-Encoding: 7bit
X-Virus-Scanned: antivirus-gw at tyumen.ru
rPath Security Advisory: 2006-0183-1
Published: 2006-10-05
Products: rPath Linux 1
Rating: Major
Exposure Level Classification:
Deterministic Unauthorized Access
Updated Versions:
nss_ldap=/conary.rpath.com@rpl:devel//1/239-9.1-1
References:
http://www.cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2005-2641http://www.cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-5170
https://issues.rpath.com/browse/RPL-680
Description:
Previous versions of the nss_ldap package do not properly handle
accounts locked using the PasswordPolicyResponse control response,
allowing potential unauthorized access from locked accounts when
systems are configured to use LDAP authentication. rPath Linux
is not configured to use LDAP authentication by default.
