CVE-2011-0438

nslcd/pam.c in the nss-pam-ldapd 0.8.0 PAM module returns a success code when a user is not found in LDAP, which allows remote attackers to bypass authentication.
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTNIST
6.8 UNKNOWN
NETWORK
MEDIUM
AV:N/AC:M/Au:N/C:P/I:P/A:P
mitreCNA
---
---
CVEADP
---
---
Base Score
CVSS 3.x
EPSS Score
Percentile: 62%
VendorProductVersion
arthurdejongnss-pam-ldapd
0.8.0
𝑥
= Vulnerable software versions
Debian logo
Debian Releases
Debian Product
Codename
nss-pam-ldapd
bullseye
0.9.11-1
fixed
bookworm
0.9.12-4
fixed
sid
0.9.12-9
fixed
trixie
0.9.12-9
fixed
Ubuntu logo
Ubuntu Releases
Ubuntu Product
Codename
nss-pam-ldapd
maverick
not-affected
lucid
not-affected
karmic
dne
hardy
dne
dapper
dne
Common Weakness Enumeration
References
http://arthurdejong.org/nss-pam-ldapd/news.html#20110309
http://lists.arthurdejong.org/nss-pam-ldapd-announce/2011/attachments/txtVf3rHgt8qQ.txt
http://lists.arthurdejong.org/nss-pam-ldapd-announce/2011/msg00000.html
http://securityreason.com/securityalert/8132
http://www.securityfocus.com/bid/46819
https://exchange.xforce.ibmcloud.com/vulnerabilities/66028
http://arthurdejong.org/nss-pam-ldapd/news.html#20110309
http://lists.arthurdejong.org/nss-pam-ldapd-announce/2011/attachments/txtVf3rHgt8qQ.txt
http://lists.arthurdejong.org/nss-pam-ldapd-announce/2011/msg00000.html
http://securityreason.com/securityalert/8132
http://www.securityfocus.com/bid/46819
https://exchange.xforce.ibmcloud.com/vulnerabilities/66028