CVE-2000-0356: Medium severity redhat Linux vulnerability
Pluggable Authentication Modules (PAM) in Red Hat Linux 6.1 does not properly lock access to disabled NIS accounts.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Remove
Remove
NIS client/servicefrom your environment.If NIS is not required, uninstall or disable the NIS client/service on affected systems to eliminate the attack surface.
- Configuration
Modify PAM account configuration to ensure disabled NIS-managed accounts are treated as locked/disabled and are denied authentication (update PAM account rules to enforce account locking for NIS accounts on affected systems).
Pluggable Authentication Modules (PAM) lock disabled NIS accounts = enabled - Compensating control
Restrict access to NIS services until a fix is applied — e.g., block NIS ports and servers with firewall/ACLs or limit NIS service access to trusted hosts only.
- Operational
Audit all NIS accounts on affected systems and manually lock or remove any accounts that are disabled to ensure they cannot be used for authentication.
Event History
Frequently Asked Questions
What is the severity of CVE-2000-0356?
The severity of CVE-2000-0356 is considered to be medium due to the exposure of disabled NIS accounts.
How do I fix CVE-2000-0356?
To fix CVE-2000-0356, ensure that the PAM configuration properly locks access to disabled NIS accounts.
What products are affected by CVE-2000-0356?
CVE-2000-0356 specifically affects Red Hat Linux versions 6.1.
Can CVE-2000-0356 lead to unauthorized access?
Yes, CVE-2000-0356 can potentially allow unauthorized access to disable NIS accounts.
Is there a patch available for CVE-2000-0356?
Yes, patches addressing CVE-2000-0356 may be available through the Red Hat update channels.