CVE-2009-1073

low-risk
Published 2009-03-31

nss-ldapd before 0.6.8 uses world-readable permissions for the /etc/nss-ldapd.conf file, which allows local users to obtain a cleartext password for the LDAP server by reading the bindpw field.

Do I need to act?

-
0.38% chance of exploitation
EPSS score — low exploit probability
-
Not on CISA KEV list
No confirmed active exploitation reported to CISA
?
Patch status unknown
Check vendor advisories for fix availability and mitigation guidance
5
CVSS 5.5/10 Medium
LOCAL / LOW complexity

Affected Products (2)

Nss-Ldap

Affected Vendors

Debian

References (24)

Broken Link http://arthurenhella.demon.nl/viewvc/nss-ldapd/nss-ldapd/debian/libnss-ldapd.pos...
Broken Link http://arthurenhella.demon.nl/viewvc/nss-ldapd/nss-ldapd/man/nss-ldapd.conf.5.xm...
Mailing List http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=520476
Broken Link http://ch.tudelft.nl/~arthur/nss-ldapd/news.html#20090322
Third Party Advisory http://launchpad.net/bugs/cve/2009-1073
Broken Link http://secunia.com/advisories/34523
Patch http://www.debian.org/security/2009/dsa-1758
Mailing List http://www.openwall.com/lists/oss-security/2009/03/23/3
Mailing List http://www.openwall.com/lists/oss-security/2009/03/24/2
Mailing List http://www.openwall.com/lists/oss-security/2009/03/25/3
Mailing List http://www.openwall.com/lists/oss-security/2009/03/25/4
Broken Link http://www.securityfocus.com/bid/34211
Broken Link http://arthurenhella.demon.nl/viewvc/nss-ldapd/nss-ldapd/debian/libnss-ldapd.pos...
Broken Link http://arthurenhella.demon.nl/viewvc/nss-ldapd/nss-ldapd/man/nss-ldapd.conf.5.xm...
Mailing List http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=520476
Broken Link http://ch.tudelft.nl/~arthur/nss-ldapd/news.html#20090322
Third Party Advisory http://launchpad.net/bugs/cve/2009-1073
Broken Link http://secunia.com/advisories/34523
Patch http://www.debian.org/security/2009/dsa-1758
Mailing List http://www.openwall.com/lists/oss-security/2009/03/23/3
and 4 more references
26
/ 100
low-risk
Severity 18/34 · Moderate
Exploitability 1/34 · Minimal
Exposure 7/34 · Low