Stay Secure with the Latest Linux Advisories

security advisorysecurity issuegentoo

Gentoo: 200507-13 Normal: pam_ldap Plain Text Authentication Leak

pam_ldap and nss_ldap fail to restart TLS when following a referral, possibly leading to credentials being sent in plain text.. - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Gentoo Linux Security Advisory GLSA 200507-13 - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - https://security.gentoo.org/ - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Severity: Normal Title: pam_ldap and nss_ldap: Plain text authentication leak Date: July 14, 2005 Bugs: #96767 ID: 200507-13 - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Synopsis ======= pam_ldap and nss_ldap fail to restart TLS when following a referral, possibly leading to credentials being sent in plain text. Background ========= pam_ldap is a Pluggable Authentication Module which allows authentication against an LDAP directory. nss_ldap is a Name Service Switch module which allows 'passwd', 'group' and 'host' database information to be pulled from LDAP. TLS is Transport Layer Security, a protocol that allows encryption of network communications. Affected packages ================ ------------------------------------------------------------------- Package / Vulnerable / Unaffected ------------------------------------------------------------------- 1 sys-auth/nss_ldap < 239-r1 > = 239-r1 *> = 226-r1 2 sys-auth/pam_ldap < 178-r1 > = 178-r1 ------------------------------------------------------------------- 2 affected packages on all of their supported architectures. ------------------------------------------------------------------- Description ========== Rob Holland of the Gentoo Security Audit Team discovered that pam_ldap and nss_ldap fail to use TLS for referred connections if theyare referred to a master after connecting to a slave, regardless of the "ssl start_tls" ldap.conf setting. Impact ===== An attacker could sniff passwords or other sensitive information as the communication is not encrypted. Workaround ========= pam_ldap and nss_ldap can be set to force the use of SSL instead of TLS. Resolution ========= All pam_ldap users should upgrade to the latest version: # emerge --sync # emerge --ask --oneshot --verbose "> =sys-auth/pam_ldap-178-r1" All nss_ldap users should upgrade to the latest version: # emerge --sync # emerge --ask --oneshot --verbose sys-auth/nss_ldap References ========= [ 1 ] CAN-2005-2069 https://www.cve.org/CVERecord?id=CVE-CAN-2005-2069 Availability =========== This GLSA and any updates to it are available for viewing at the Gentoo Security Website: https://security.gentoo.org/glsa/200507-13 Concerns? ======== Security is a primary focus of Gentoo Linux and ensuring the confidentiality and security of our users machines is of utmost importance to us. Any security concerns should be addressed to This email address is being protected from spambots. You need JavaScript enabled to view it. or alternatively, you may file a bug at https://bugs.gentoo.org/. License ====== Copyright 2005 Gentoo Foundation, Inc; referenced text belongs to its owner(s). The contents of this document are licensed under the Creative Commons - Attribution / Share Alike license. https://creativecommons.org/licenses/by-sa/2.0/ . Discover the typical risks associated with pam_ldap and nss_ldap password authentication exposures and how to resolve them.. pam_ldap,nss_ldap,authentication,security issue. . LinuxSecurity.com Team

Jul 14, 2005 Gentoo