pam_ldap in nss_ldap on Red Hat Enterprise Linux 4, Fedora Core 3 and earlier, and possibly other distributions does not return an error condition when an LDAP directory server responds with a PasswordPolicyResponse control response, which causes the pam_authenticate function to return a success code even if authentication has failed, as originally reported for xscreensaver.
The product does not handle or incorrectly handles an exceptional condition.
| Name | Vendor | Start Version | End Version |
|---|---|---|---|
| Fedora_core | Fedoraproject | * | core_3.0 (including) |
| Enterprise_linux | Redhat | 4.0 (including) | 4.0 (including) |
| Libpam-ldap | Ubuntu | dapper | * |
| Libpam-ldap | Ubuntu | devel | * |
| Libpam-ldap | Ubuntu | edgy | * |
| Libpam-ldap | Ubuntu | feisty | * |
| Red Hat Enterprise Linux 4 | RedHat | nss_ldap-0:226-17 | * |