CVE-2005-3567

slapd daemon in IBM Tivoli Directory Server (ITDS) 5.2.0 and 6.0.0 binds using SASL EXTERNAL, which allows attackers to bypass authentication and modify and delete directory data via unknown attack vectors.

CVSS v2.0 5.8 MEDIUM

5.8^/10

CVSS v2.0 : MEDIUM

V2 Legend

Vector : AV:A/AC:L/Au:N/C:P/I:P/A:P

Exploitability : 6.5 / Impact : 6.4

Access Vector ADJACENT_NETWORK

Access Complexity LOW

Authentication NONE

Confidentiality Impact PARTIAL

Integrity Impact PARTIAL

Availability Impact PARTIAL

References

Link	Resource
http://www-1.ibm.com/support/docview.wss?rs=767&context=SSVJJU&dc=D400&uid=swg24010819&loc=en_US&cs=UTF-8&lang=en	Patch Vendor Advisory
http://www-1.ibm.com/support/docview.wss?uid=swg21222159	Patch Vendor Advisory
http://securitytracker.com/id?1015171	Patch
http://secunia.com/advisories/17484	Patch Vendor Advisory
http://www-1.ibm.com/support/docview.wss?uid=isg1SSRVAIX53SECUR081510_247
http://www.kb.cert.org/vuls/id/194753	US Government Resource
http://www.securityfocus.com/bid/15367	Patch
http://www.osvdb.org/20672	Patch
http://www-1.ibm.com/support/search.wss?rs=0&q=IO02697&apar=only
http://www-1.ibm.com/support/search.wss?rs=0&q=IO02714&apar=only
http://www.vupen.com/english/advisories/2005/2356	Vendor Advisory
https://exchange.xforce.ibmcloud.com/vulnerabilities/22989

Configurations

Configuration 1 (hide)

OR	cpe:2.3:a:ibm:tivoli_directory_server:5.2.0:::::::*
	cpe:2.3:a:ibm:tivoli_directory_server:6.0:::::::*

Information

Published : 2005-11-15 23:42

Updated : 2017-07-10 18:33

NVD link : CVE-2005-3567

Mitre link : CVE-2005-3567

JSON object : View

CWE

CWE-264

Permissions, Privileges, and Access Controls

Products Affected

ibm

tivoli_directory_server

{"cve": {"data_type": "CVE", "references": {"reference_data": [{"url": "http://www-1.ibm.com/support/docview.wss?rs=767&context=SSVJJU&dc=D400&uid=swg24010819&loc=en_US&cs=UTF-8&lang=en", "name": "http://www-1.ibm.com/support/docview.wss?rs=767&context=SSVJJU&dc=D400&uid=swg24010819&loc=en_US&cs=UTF-8&lang=en", "tags": ["Patch", "Vendor Advisory"], "refsource": "CONFIRM"}, {"url": "http://www-1.ibm.com/support/docview.wss?uid=swg21222159", "name": "http://www-1.ibm.com/support/docview.wss?uid=swg21222159", "tags": ["Patch", "Vendor Advisory"], "refsource": "CONFIRM"}, {"url": "http://securitytracker.com/id?1015171", "name": "1015171", "tags": ["Patch"], "refsource": "SECTRACK"}, {"url": "http://secunia.com/advisories/17484", "name": "17484", "tags": ["Patch", "Vendor Advisory"], "refsource": "SECUNIA"}, {"url": "http://www-1.ibm.com/support/docview.wss?uid=isg1SSRVAIX53SECUR081510_247", "name": "http://www-1.ibm.com/support/docview.wss?uid=isg1SSRVAIX53SECUR081510_247", "tags": [], "refsource": "CONFIRM"}, {"url": "http://www.kb.cert.org/vuls/id/194753", "name": "VU#194753", "tags": ["US Government Resource"], "refsource": "CERT-VN"}, {"url": "http://www.securityfocus.com/bid/15367", "name": "15367", "tags": ["Patch"], "refsource": "BID"}, {"url": "http://www.osvdb.org/20672", "name": "20672", "tags": ["Patch"], "refsource": "OSVDB"}, {"url": "http://www-1.ibm.com/support/search.wss?rs=0&q=IO02697&apar=only", "name": "IO02697", "tags": [], "refsource": "AIXAPAR"}, {"url": "http://www-1.ibm.com/support/search.wss?rs=0&q=IO02714&apar=only", "name": "IO02714", "tags": [], "refsource": "AIXAPAR"}, {"url": "http://www.vupen.com/english/advisories/2005/2356", "name": "ADV-2005-2356", "tags": ["Vendor Advisory"], "refsource": "VUPEN"}, {"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/22989", "name": "tivoli-directory-bypass-security(22989)", "tags": [], "refsource": "XF"}]}, "data_format": "MITRE", "description": {"description_data": [{"lang": "en", "value": "slapd daemon in IBM Tivoli Directory Server (ITDS) 5.2.0 and 6.0.0 binds using SASL EXTERNAL, which allows attackers to bypass authentication and modify and delete directory data via unknown attack vectors."}]}, "problemtype": {"problemtype_data": [{"description": [{"lang": "en", "value": "CWE-264"}]}]}, "data_version": "4.0", "CVE_data_meta": {"ID": "CVE-2005-3567", "ASSIGNER": "cve@mitre.org"}}, "impact": {"baseMetricV2": {"cvssV2": {"version": "2.0", "baseScore": 5.8, "accessVector": "ADJACENT_NETWORK", "vectorString": "AV:A/AC:L/Au:N/C:P/I:P/A:P", "authentication": "NONE", "integrityImpact": "PARTIAL", "accessComplexity": "LOW", "availabilityImpact": "PARTIAL", "confidentialityImpact": "PARTIAL"}, "severity": "MEDIUM", "impactScore": 6.4, "obtainAllPrivilege": false, "exploitabilityScore": 6.5, "obtainUserPrivilege": false, "obtainOtherPrivilege": true, "userInteractionRequired": false}}, "publishedDate": "2005-11-16T07:42Z", "configurations": {"nodes": [{"children": [], "operator": "OR", "cpe_match": [{"cpe23Uri": "cpe:2.3:a:ibm:tivoli_directory_server:5.2.0:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true}, {"cpe23Uri": "cpe:2.3:a:ibm:tivoli_directory_server:6.0:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true}]}], "CVE_data_version": "4.0"}, "lastModifiedDate": "2017-07-11T01:33Z"}

5.8 /10