Freely subscribe to our NEWSLETTER

This bulletin was written by Vigil@nce : http://vigilance.fr/

SYNTHESIS OF THE VULNERABILITY

When the LDAP authentication is enabled on AIX bos.rte.security
6.1.6.4, an attacker can authenticate with an incorrect password.

Severity: 2/4

Creation date: 01/04/2011

IMPACTED PRODUCTS

– IBM AIX

DESCRIPTION OF THE VULNERABILITY

The system can be configured to process the authentication of
users via a LDAP directory. In this case:
– the /etc/security/ldap/ldap.cfg file contains ldap_auth
– the /etc/security/user file (or the default stanza) contains:
SYSTEM = "LDAP or compat"

However, the bos.rte.security 6.1.6.4 fileset does not correctly
check the LDAP password. Technical details are unknown.

When the LDAP authentication is enabled on AIX bos.rte.security
6.1.6.4, an attacker can therefore authenticate with an incorrect
password.

ACCESS TO THE COMPLETE VIGIL@NCE BULLETIN

http://vigilance.fr/vulnerability/AIX-6-1-authentication-via-LDAP-10506