[ GLSA 200507-13 ] pam_ldap and nss_ldap: Plain text authentication leak

[Thierry Carrez <koon () gentoo org>]

- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Gentoo Linux Security Advisory                           GLSA 200507-13
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
                                            http://security.gentoo.org/
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -

  Severity: Normal
     Title: pam_ldap and nss_ldap: Plain text authentication leak
      Date: July 14, 2005
      Bugs: #96767
        ID: 200507-13

- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -

Synopsis
========

pam_ldap and nss_ldap fail to restart TLS when following a referral,
possibly leading to credentials being sent in plain text.

Background
==========

pam_ldap is a Pluggable Authentication Module which allows
authentication against an LDAP directory. nss_ldap is a Name Service
Switch module which allows 'passwd', 'group' and 'host' database
information to be pulled from LDAP. TLS is Transport Layer Security, a
protocol that allows encryption of network communications.

Affected packages
=================

    -------------------------------------------------------------------
     Package            /  Vulnerable  /                    Unaffected
    -------------------------------------------------------------------
  1  sys-auth/nss_ldap      < 239-r1                         >= 239-r1
                                                            *>= 226-r1
  2  sys-auth/pam_ldap      < 178-r1                         >= 178-r1
    -------------------------------------------------------------------
     2 affected packages on all of their supported architectures.
    -------------------------------------------------------------------

Description
===========

Rob Holland of the Gentoo Security Audit Team discovered that pam_ldap
and nss_ldap fail to use TLS for referred connections if they are
referred to a master after connecting to a slave, regardless of the
"ssl start_tls" ldap.conf setting.

Impact
======

An attacker could sniff passwords or other sensitive information as the
communication is not encrypted.

Workaround
==========

pam_ldap and nss_ldap can be set to force the use of SSL instead of
TLS.

Resolution
==========

All pam_ldap users should upgrade to the latest version:

    # emerge --sync
    # emerge --ask --oneshot --verbose ">=sys-auth/pam_ldap-178-r1"

All nss_ldap users should upgrade to the latest version:

    # emerge --sync
    # emerge --ask --oneshot --verbose sys-auth/nss_ldap

References
==========

  [ 1 ] CAN-2005-2069
        http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2005-2069

Availability
============

This GLSA and any updates to it are available for viewing at
the Gentoo Security Website:

  http://security.gentoo.org/glsa/glsa-200507-13.xml

Concerns?
=========

Security is a primary focus of Gentoo Linux and ensuring the
confidentiality and security of our users machines is of utmost
importance to us. Any security concerns should be addressed to
security () gentoo org or alternatively, you may file a bug at
http://bugs.gentoo.org.

License
=======

Copyright 2005 Gentoo Foundation, Inc; referenced text
belongs to its owner(s).

The contents of this document are licensed under the
Creative Commons - Attribution / Share Alike license.

http://creativecommons.org/licenses/by-sa/2.0

Attachment: signature.asc
Description: OpenPGP digital signature