CVE-2006-5170
HighSummary
W systemach Red Hat Enterprise Linux 4, Fedora Core 3 i wcześniejszych, moduł pam_ldap w nss_ldap nie zwraca błędu, gdy serwer LDAP odpowiada kontrolą PasswordPolicyResponse. To powoduje, że funkcja pam_authenticate zwraca kod sukcesu, nawet jeśli uwierzytelnienie nie powiodło się.
Risk Assessment
Organizacja może być narażona na nieautoryzowany dostęp, ponieważ system może błędnie uznać, że uwierzytelnienie zakończyło się sukcesem, co zagraża bezpieczeństwu danych.
Recommendation
Zaleca się aktualizację systemu do najnowszej wersji oraz monitorowanie logów uwierzytelniania w celu wykrycia potencjalnych nieprawidłowości.
Related vulnerabilities
- CVE-2026-86167Critical
A vulnerability was identified in Tenda HG10 (version 300001138) in the formgponConf function of the /boaform/admin/formgponConf file in the Boa component. Manipulation of the fmgpon_loid argument leads to OS command injection. The attack can be performed remotely, and the exploit is publicly available.
- CVE-2026-86165Critical
A vulnerability was found in Tenda HG10 (version 300001138) in the formURL function of the /boaform/admin/formURL file. Manipulation of the Keywd/urlFQDN arguments results in a buffer overflow. The attack can be initiated remotely, and the exploit has been made public.
- CVE-2026-86218Critical
N-central is vulnerable to pre-auth remote code execution. This issue affects N-central before version 2026.3.1.14.
- CVE-2026-75816Critical
The Frontend Admin by DynamiApps plugin for WordPress is vulnerable to Authentication Bypass to Account Takeover in all versions up to and including 3.29.12. The pre_update_value function lacks capability or ownership checks, and ActionPost::conditions_logic() short-circuits the current_user_can('edit_post') authorization gate when the post ID is non-numeric, allowing unauthenticated form submissions to be routed to arbitrary user records. This enables unauthenticated attackers to overwrite any user's email address, including an administrator's, and then use WordPress's native password-reset flow to take over the account.
- CVE-2026-16310Critical
The MemberDash plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to and including 1.8.5 via the 'id' parameter due to missing validation on a user-controlled key. This allows unauthenticated attackers to change the password of any WordPress user, including administrators, by supplying an arbitrary user ID during registration, and take over their account without any notification to the victim.
- CVE-2026-86153Critical
A vulnerability has been found in Tenda CP3 (version 27.5.57.101) in the CRedirServer::SetRedirectEnable function of the Functions/Redirect.cpp file. The manipulation leads to improper privilege management. Remote exploitation is possible.
- CVE-2026-86152Critical
A flaw has been found in Tenda CP3 (version 27.5.57.101) in the CAutoAddWifi::ThreadProc function of the Functions/AutoAddWifi.cpp file in the Kylin component. Executing a manipulation can lead to OS command injection. The attack may be launched remotely.
- CVE-2026-86151Critical
A vulnerability was detected in Tenda CP3 (version 27.5.57.101) in the sub_2F77E8 function of the Apis/system.c file in the Network Configuration Management component. Performing a manipulation results in OS command injection. The attack may be initiated remotely.
- CVE-2026-86149Critical
A vulnerability has been identified in Tenda CP3 27.5.57.101 in the file Net/NetCheckPing.cpp. Manipulation of the interface_name/host arguments causes OS command injection. The attack can be initiated remotely.
- CVE-2026-86148Critical
A vulnerability has been discovered in Tenda CP3 27.5.57.101 in the SystemAsh function of the file Apis/system.c of the Kylin component. Manipulation of the AlarmVoiceURL argument results in OS command injection. The attack can be launched remotely.
Original NVD description (English source)
pam_ldap in nss_ldap on Red Hat Enterprise Linux 4, Fedora Core 3 and earlier, and possibly other distributions does not return an error condition when an LDAP directory server responds with a PasswordPolicyResponse control response, which causes the pam_authenticate function to return a success code even if authentication has failed, as originally reported for xscreensaver.