Description
nslcd/pam.c in the nss-pam-ldapd 0.8.0 PAM module returns a success code when a user is not found in LDAP, which allows remote attackers to bypass authentication.
References
- 8132 third-party-advisory
- 46819 vdb-entry
- nsspamldapd-pam-sec-bypass(66028) vdb-entry
- http://lists.arthurdejong.org/nss-pam-ldapd-announce/2011/attachments/txtVf3rHgt8qQ.txt
- [nss-pam-ldapd-announce] 20110309 nss-pam-ldapd security advisory (CVE-2011-0438) mailing-list
- http://arthurdejong.org/nss-pam-ldapd/news.html#20110309