CVE-2010-3282: Low severity hp-ux directory server vulnerability
389 Directory Server before 1.2.7.1 (aka Red Hat Directory Server 8.2) and HP-UX Directory Server before B.08.10.03, when audit logging is enabled, logs the Directory Manager password (nsslapd-rootpw) in cleartext when changing cn=config:nsslapd-rootpw, which might allow local users to obtain sensitive information by reading the log.
Other sources
When audit logging is enabled on Red Hat Directory Server and 389 Directory Server, changes to cn=config:nsslapd-rootpw result in the password value being logged in cleartext. The audit log records an entry similar to the following:
dn: cn=config changetype: modify replace: nsslapd-rootpw nsslapd-rootpw: secret
User passwords, however, are not logged verbatim but in hashed form.
Although the directory server administrator can configure the path and permissions of the audit log, by default it is mode 0600, owned by the directory server user, and is located in the directory server log directory (/var/log/dirsrv/slapd-[hostname]), which is mode 0770 and owned by the directory server user ("nobody", by default)
— Red Hat
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2010-3282?
CVE-2010-3282 has a medium severity level due to the potential exposure of sensitive password information.
How do I fix CVE-2010-3282?
To address CVE-2010-3282, upgrade to version 1.2.7.1 or later of the 389 Directory Server.
Who is affected by CVE-2010-3282?
CVE-2010-3282 affects users of 389 Directory Server versions prior to 1.2.7.1 and HP-UX Directory Server versions prior to B.08.10.03.
What does CVE-2010-3282 expose?
CVE-2010-3282 exposes the Directory Manager password in cleartext in audit logs, posing a security risk for local users.
When was CVE-2010-3282 published?
CVE-2010-3282 was published on September 28, 2010.