CVE-2006-5170: High severity redhat enterprise linux vulnerability
pamldap in nssldap on Red Hat Enterprise Linux 4, Fedora Core 3 and earlier, and possibly other distributions does not return an error condition when an LDAP directory server responds with a PasswordPolicyResponse control response, which causes the pamauthenticate function to return a success code even if authentication has failed, as originally reported for xscreensaver.
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2006-5170?
CVE-2006-5170 has been classified as a high severity vulnerability due to its potential impact on authentication processes.
How do I fix CVE-2006-5170?
To fix CVE-2006-5170, users should upgrade to a version of pam_ldap that properly handles PasswordPolicyResponse control responses.
Which systems are affected by CVE-2006-5170?
CVE-2006-5170 affects Red Hat Enterprise Linux 4, Fedora Core 3 and earlier, and possibly other distributions using vulnerable versions of pam_ldap.
What type of vulnerability is CVE-2006-5170?
CVE-2006-5170 is an authentication vulnerability that allows pam_authenticate to incorrectly return a success code.
Does CVE-2006-5170 impact LDAP directory services?
Yes, CVE-2006-5170 affects how pam_ldap interacts with LDAP directory services, leading to potential unauthorized access.