CVE-2009-1073

MEDIUM 5.5CVE-2009-1073 · Published 31/03/2009 · updated 16/06/2026

In short

CVE-2009-1073 is a MEDIUM (CVSS 5.5) vulnerability affecting nss-ldap (debian).
Chance of exploitation in the next 30 days (EPSS): 1.1%, higher than 64.6% of all vulnerabilities.
Fix: update to 0.6.8 or later.

Package	Affected versions	Patched versions
nss-ldap debian	`< 0.6.8`	`0.6.8`

Description

nss-ldapd before 0.6.8 uses world-readable permissions for the /etc/nss-ldapd.conf file, which allows local users to obtain a cleartext password for the LDAP server by reading the bindpw field.

References

arthurenhella.demon.nl/viewvc/nss-ldapd/nss-ldapd/debian/libnss-ldapd.postinst · Broken Link
arthurenhella.demon.nl/viewvc/nss-ldapd/nss-ldapd/man/nss-ldapd.conf.5.xml · Broken Link
bugs.debian.org/cgi-bin/bugreport.cgi · Mailing List
ch.tudelft.nl/~arthur/nss-ldapd/news.html · Broken Link
launchpad.net/bugs/cve/2009-1073 · Third Party Advisory
secunia.com/advisories/34523 · Broken Link
debian.org/security/2009/dsa-1758 · Patch
openwall.com/lists/oss-security/2009/03/23/3 · Mailing List
openwall.com/lists/oss-security/2009/03/24/2 · Mailing List
openwall.com/lists/oss-security/2009/03/25/3 · Mailing List
openwall.com/lists/oss-security/2009/03/25/4 · Mailing List

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free