5.5

CVE-2009-1073

Exploit
nss-ldapd before 0.6.8 uses world-readable permissions for the /etc/nss-ldapd.conf file, which allows local users to obtain a cleartext password for the LDAP server by reading the bindpw field.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Debian ≫ Nss-ldap Version < 0.6.8
Debian ≫ Debian Linux Version5.0
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 0.93% 0.557
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
nvd@nist.gov 5.5 1.8 3.6
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
nvd@nist.gov 4.9 3.9 6.9
AV:L/AC:L/Au:N/C:C/I:N/A:N
CWE-732 Incorrect Permission Assignment for Critical Resource

The product specifies permissions for a security-critical resource in a way that allows that resource to be read or modified by unintended actors.

http://arthurenhella.demon.nl/viewvc/nss-ldapd/nss-ldapd/debian/libnss-ldapd.postinst?r1=795&r2=813
Exploit
Broken Link
http://arthurenhella.demon.nl/viewvc/nss-ldapd/nss-ldapd/man/nss-ldapd.conf.5.xml?r1=805&r2=806
Broken Link
http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=520476
Patch
Mailing List
http://ch.tudelft.nl/~arthur/nss-ldapd/news.html#20090322
Broken Link
http://launchpad.net/bugs/cve/2009-1073
Third Party Advisory
http://secunia.com/advisories/34523
Broken Link
http://www.debian.org/security/2009/dsa-1758
Patch
Third Party Advisory
http://www.openwall.com/lists/oss-security/2009/03/23/3
Mailing List
http://www.openwall.com/lists/oss-security/2009/03/24/2
Mailing List
http://www.openwall.com/lists/oss-security/2009/03/25/3
Mailing List
http://www.openwall.com/lists/oss-security/2009/03/25/4
Mailing List
http://www.securityfocus.com/bid/34211
Third Party Advisory
Broken Link
VDB Entry