[19276] in bugtraq
Solaris 8 pam_ldap.so.1 module broken
daemon@ATHENA.MIT.EDU (Caleb David)
Mon Feb 19 18:29:35 2001
Mime-Version: 1.0
Content-Type: text/plain; charset=us-ascii
Content-Transfer-Encoding: 7bit
Message-Id: <14990.15143.417997.154979@c217057-a.plstn1.sfba.home.com>
Date: Sat, 17 Feb 2001 00:49:43 -0800
Reply-To: Caleb David <avatar@VERY.STRANGE.COM>
From: Caleb David <avatar@VERY.STRANGE.COM>
To: BUGTRAQ@SECURITYFOCUS.COM
I looked through the archives back to November 2000 and didn't see
this mentioned. Apologies if it's there and I missed it.
Sunsolve has bugid 4384816 on file regarding this issue. It's been
known since 06-Nov-2000 with a status of 'Evaluated' but no workaround
or other information, helpful or otherwise, posted as yet.
The problem is that if you use this module for authentication, as
configured in pam.conf per the pam_ldap manpage (for example),
entering a NULL password is a quick way to get a login shell prompt.
That is, entering a NULL password is technically equivalent to
entering the correct password as far as this module is concerned.
Providing an incorrect password (other than NULL, of course) or a
valid password results in proper behavior.
Using the pam_ldap module compiled from source code available at
http://www.padl.com appears to work correctly though I've only had
time to test against the problem described above.
-Caleb
--
Caleb David
avatar@very.strange.com
