Description
pam_ldap and nss_ldap, when used with OpenLDAP and connecting to a slave using TLS, does not use TLS for the subsequent connection if the client is referred to a master, which may cause a password to be sent in cleartext and allows remote attackers to sniff the password.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 11 | libnss-ldap | 238-1.1 | — |
| Debian 11 | libpam-ldap | 178-1sarge1 | — |
| Debian 3.1 | libpam-ldap | 178-1sarge1 | DSA-785-1 |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 4 | compat-openldap | 2.1.30-4 | RHSA-2005:767 |
| RHEL 4 | nss_ldap | 226-10 | RHSA-2005:767 |
| RHEL 4 | openldap +4 | 2.2.13-4 | RHSA-2005:767 |
| RHEL 3 | nss_ldap | 207-17 | RHSA-2005:751 |
| RHEL 3 | openldap +3 | 2.0.27-20 | RHSA-2005:751 |
Advisories 3
- RHSA-2005:751 Red Hat Security Advisory: openldap and nss_ldap security update Red Hat Security Advisories (RHSA) · Jun 26, 2026
- RHSA-2005:767 Red Hat Security Advisory: openldap and nss_ldap security update Red Hat Security Advisories (RHSA) · Jun 26, 2026
- DSA-785-1 libpam-ldap - authentication bypass Debian Security (DSA / DLA) · Mar 9, 2026
References
- https://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=161990
- GLSA-2005-07-13 vendor-advisory
- http://bugs.gentoo.org/show_bug.cgi?id=96767
- http://support.avaya.com/elmodocs2/security/ASA-2006-157.htm
- 14126 vdb-entry
- RHSA-2005:751 vendor-advisory
- ldap-tls-information-disclosure(21245) vdb-entry
- 17692 vdb-entry
- http://www.openldap.org/its/index.cgi/Incoming?id=3791
- 20050704 pam_ldap/nss_ldap password leak in a master+slave+start_tls LDAP setup mailing-list
- http://bugzilla.padl.com/show_bug.cgi?id=210
- 17845 third-party-advisory
- 14125 vdb-entry
- oval:org.mitre.oval:def:9445 vdb-entry signature
- http://bugzilla.padl.com/show_bug.cgi?id=211
- MDKSA-2005:121 vendor-advisory
- 21520 third-party-advisory
- RHSA-2005:767 vendor-advisory
- 17233 third-party-advisory
- USN-152-1 vendor-advisory