OSVDB ID: 83233 Title: 389 Directory Server LDAP Password Change Remote Unhashed Password Disclosure |
Info |
|
|
Dates |
||||
|
|
Description |
389 Directory Server contains a flaw that may lead to an unauthorized information disclosure. The issue is triggered by LDAP during password change operations, which will disclose unhashed password information to an attacker with access to network traffic between the LDAP server and the user. |
Classification |
Location:
Remote / Network Access
Attack Type: Cryptographic, Information Disclosure Impact: Loss of Confidentiality Solution: Upgrade Exploit: Exploit Public Disclosure: Vendor Verified |
Solution |
Upgrade to version 1.2.11.6 or higher, as it has been reported to fix this vulnerability. An upgrade is required as there are no known workarounds. |
Products |
|
References |
|
Credit |
Unknown or Incomplete |