CVE-2010-0833

CRÍTICO 9.3CVE-2010-0833 · Published 28/07/2010 · updated 16/06/2026

En resumen

CVE-2010-0833 es una vulnerabilidad CRÍTICO (CVSS 9.3) que afecta a likewise cifs (likewise), likewise open (likewise).
Probabilidad de explotación en los próximos 30 días (EPSS): 4.1%, mayor que el 90.8% de las vulnerabilidades.
Aún no hay una versión corregida: sigue el aviso del fabricante en Referencias.

Package	Affected versions	Patched versions
likewise cifs likewise	`= 5.4`	No fix yet
likewise open likewise	`= 5.4= 6.0`	No fix yet

Description

The pam_lsass library in Likewise Open 5.4 and CIFS 5.4 before build 8046, and 6.0 before build 8234, as used in HP StorageWorks X9000 Network Storage Systems and possibly other products, uses "SetPassword logic" when running as part of a root service, which allows remote attackers to bypass authentication for a Likewise Security Authority (lsassd) account whose password is marked as expired.

References

marc.info
secunia.com/advisories/40725 · Vendor Advisory
secunia.com/advisories/40736 · Vendor Advisory
secunia.com/advisories/43244 · Vendor Advisory
likewise.com/community/index.php/forums/viewthread/772 · Patch
securityfocus.com/archive/1/512643/100/0/threaded
securitytracker.com/id
ubuntu.com/usn/USN-964-1
vupen.com/english/advisories/2010/1913 · Vendor Advisory
vupen.com/english/advisories/2011/0312 · Vendor Advisory

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free