CVE-2005-2069

Publication date 30 June 2005

Last updated 24 July 2024

Ubuntu priority

Unknown

Why this priority?

pam_ldap and nss_ldap, when used with OpenLDAP and connecting to a slave using TLS, does not use TLS for the subsequent connection if the client is referred to a master, which may cause a password to be sent in cleartext and allows remote attackers to sniff the password.

Status

Package Ubuntu Release Status
libnss-ldap 7.04 feisty Ignored end of life, was needed
6.10 edgy Ignored end of life, was needed
6.06 LTS dapper
Fixed 238-1.1ubuntu1
openldap2 7.04 feisty
Fixed 2.1.30-12ubuntu3
6.10 edgy
Fixed 2.1.30-12ubuntu3
6.06 LTS dapper
Fixed 2.1.30-12ubuntu3
openldap2.2 7.04 feisty Not in release
6.10 edgy
Fixed 2.2.26-5ubuntu3.1
6.06 LTS dapper
Fixed 2.2.26-5ubuntu2.2
openldap2.3 7.04 feisty
Fixed 2.3.30-2
6.10 edgy Not in release
6.06 LTS dapper Not in release

References

Related Ubuntu Security Notices (USN)

    • USN-152-1
    • PAM/NSS LDAP vulnerabilitiy
    • 21 July 2005

Other references