pam_ldap: Authentication bypass vulnerability

pam_ldap: Authentication bypass vulnerability pam_ldap contains a vulnerability that may allow a remote user with a locked account to gain unauthorized system access. pam_ldap December 20, 2006 December 20, 2006: 01 153916 remote 183 183

pam_ldap is a Pluggable Authentication Module which allows authentication against LDAP directories.

Steve Rigler discovered that pam_ldap does not correctly handle "PasswordPolicyResponse" control responses from an LDAP directory. This causes the pam_authenticate() function to always succeed, even if the previous authentication failed.

A locked user may exploit this vulnerability to bypass the LDAP authentication mechanism, possibly gaining unauthorized access to the system.

There is no known workaround at this time.

All pam_ldap users should upgrade to the latest version:


    # emerge --sync
    # emerge --ask --oneshot --verbose ">=sys-auth/pam_ldap-183"

CVE-2006-5170 falco falco