CVE-2005-2069

Severity: medium (CVSS 5.0 v2.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 2.8% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2005-06-30 · updated 2026-06-16
Weakness: CWE-319

Description

pam_ldap and nss_ldap, when used with OpenLDAP and connecting to a slave using TLS, does not use TLS for the subsequent connection if the client is referred to a master, which may cause a password to be sent in cleartext and allows remote attackers to sniff the password.

Affected products

Padl Nss Ldap: all versions
Padl Pam Ldap: all versions

References

http://archives.neohapsis.com/archives/fulldisclosure/2005-07/0060.html
http://bugs.gentoo.org/show_bug.cgi?id=96767
http://bugzilla.padl.com/show_bug.cgi?id=210
http://bugzilla.padl.com/show_bug.cgi?id=211
http://secunia.com/advisories/17233
http://secunia.com/advisories/17845
http://secunia.com/advisories/21520
http://support.avaya.com/elmodocs2/security/ASA-2006-157.htm
http://www.gentoo.org/security/en/glsa/glsa-200507-13.xml
http://www.openldap.org/its/index.cgi/Incoming?id=3791
http://www.osvdb.org/17692
http://www.redhat.com/support/errata/RHSA-2005-751.html

Get alerted when CVE-2005-2069 or the next vulnerability affects your stack