Description
pam_ldap in nss_ldap on Red Hat Enterprise Linux 4, Fedora Core 3 and earlier, and possibly other distributions does not return an error condition when an LDAP directory server responds with a PasswordPolicyResponse control response, which causes the pam_authenticate function to return a success code even if authentication has failed, as originally reported for xscreensaver.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 11 | libpam-ldap | 180-1.2 | — |
| Debian 3.1 | libpam-ldap | 178-1sarge3 | DSA-1203-1 |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 4 | nss_ldap | 226-17 | RHSA-2006:0719 |
Advisories 2
- RHSA-2006:0719 Red Hat Security Advisory: nss_ldap security update Red Hat Security Advisories (RHSA) · Jun 26, 2026
- DSA-1203-1 libpam-ldap Debian Security (DSA / DLA) · Mar 9, 2026
References
- 1017153 vdb-entry
- RHSA-2006:0719 vendor-advisory
- https://issues.rpath.com/browse/RPL-680
- 22682 third-party-advisory
- 20061005 rPSA-2006-0183-1 nss_ldap mailing-list
- 2006-0061 vendor-advisory
- 20880 vdb-entry
- 22685 third-party-advisory
- MDKSA-2006:201 vendor-advisory
- SUSE-SR:2006:027 vendor-advisory
- 22869 third-party-advisory
- 22694 third-party-advisory
- 23132 third-party-advisory
- GLSA-200612-19 vendor-advisory
- 23428 third-party-advisory
- oval:org.mitre.oval:def:10418 vdb-entry signature
- DSA-1203 vendor-advisory
- http://bugzilla.padl.com/show_bug.cgi?id=291
- https://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=207286
- 22696 third-party-advisory
- ADV-2006-4319 vdb-entry