CVE-2006-0150

Multiple format string vulnerabilities in the auth_ldap_log_reason function in Apache auth_ldap 1.6.0 and earlier allows remote attackers to execute arbitrary code via various vectors, including the username.
References
Link Resource
http://secunia.com/advisories/18382 Patch Vendor Advisory
http://secunia.com/advisories/18405 Patch Vendor Advisory
http://secunia.com/advisories/18412 Patch Vendor Advisory
http://secunia.com/advisories/18568 Patch Vendor Advisory
http://securitytracker.com/id?1015456
http://www.debian.org/security/2006/dsa-952 Patch Vendor Advisory
http://www.digitalarmaments.com/2006090173928420.html Vendor Advisory URL Repurposed
http://www.redhat.com/support/errata/RHSA-2006-0179.html Patch Vendor Advisory
http://www.rudedog.org/auth_ldap/Changes.html
http://www.securityfocus.com/archive/1/421286/100/0/threaded
http://www.securityfocus.com/bid/16177 Patch
http://www.vupen.com/english/advisories/2006/0117 Vendor Advisory
http://wwwnew.mandriva.com/security/advisories?name=MDKSA-2006:017 Patch Vendor Advisory
https://exchange.xforce.ibmcloud.com/vulnerabilities/24030
http://secunia.com/advisories/18382 Patch Vendor Advisory
http://secunia.com/advisories/18405 Patch Vendor Advisory
http://secunia.com/advisories/18412 Patch Vendor Advisory
http://secunia.com/advisories/18568 Patch Vendor Advisory
http://securitytracker.com/id?1015456
http://www.debian.org/security/2006/dsa-952 Patch Vendor Advisory
http://www.digitalarmaments.com/2006090173928420.html Vendor Advisory URL Repurposed
http://www.redhat.com/support/errata/RHSA-2006-0179.html Patch Vendor Advisory
http://www.rudedog.org/auth_ldap/Changes.html
http://www.securityfocus.com/archive/1/421286/100/0/threaded
http://www.securityfocus.com/bid/16177 Patch
http://www.vupen.com/english/advisories/2006/0117 Vendor Advisory
http://wwwnew.mandriva.com/security/advisories?name=MDKSA-2006:017 Patch Vendor Advisory
https://exchange.xforce.ibmcloud.com/vulnerabilities/24030
Configurations

Configuration 1 (hide)

OR cpe:2.3:a:dave_carrigan:auth_ldap:1.2.1:*:*:*:*:*:*:*
cpe:2.3:a:dave_carrigan:auth_ldap:1.2.2:*:*:*:*:*:*:*
cpe:2.3:a:dave_carrigan:auth_ldap:1.2.3:*:*:*:*:*:*:*
cpe:2.3:a:dave_carrigan:auth_ldap:1.2.4:*:*:*:*:*:*:*
cpe:2.3:a:dave_carrigan:auth_ldap:1.3.0:*:*:*:*:*:*:*
cpe:2.3:a:dave_carrigan:auth_ldap:1.3.1:*:*:*:*:*:*:*
cpe:2.3:a:dave_carrigan:auth_ldap:1.3.2:*:*:*:*:*:*:*
cpe:2.3:a:dave_carrigan:auth_ldap:1.3.3:*:*:*:*:*:*:*
cpe:2.3:a:dave_carrigan:auth_ldap:1.3.4:*:*:*:*:*:*:*
cpe:2.3:a:dave_carrigan:auth_ldap:1.4.0:*:*:*:*:*:*:*
cpe:2.3:a:dave_carrigan:auth_ldap:1.4.2:*:*:*:*:*:*:*
cpe:2.3:a:dave_carrigan:auth_ldap:1.4.3:*:*:*:*:*:*:*
cpe:2.3:a:dave_carrigan:auth_ldap:1.6.0:*:*:*:*:*:*:*

History

21 Nov 2024, 00:05

Type Values Removed Values Added
References () http://secunia.com/advisories/18382 - Patch, Vendor Advisory () http://secunia.com/advisories/18382 - Patch, Vendor Advisory
References () http://secunia.com/advisories/18405 - Patch, Vendor Advisory () http://secunia.com/advisories/18405 - Patch, Vendor Advisory
References () http://secunia.com/advisories/18412 - Patch, Vendor Advisory () http://secunia.com/advisories/18412 - Patch, Vendor Advisory
References () http://secunia.com/advisories/18568 - Patch, Vendor Advisory () http://secunia.com/advisories/18568 - Patch, Vendor Advisory
References () http://securitytracker.com/id?1015456 - () http://securitytracker.com/id?1015456 -
References () http://www.debian.org/security/2006/dsa-952 - Patch, Vendor Advisory () http://www.debian.org/security/2006/dsa-952 - Patch, Vendor Advisory
References () http://www.digitalarmaments.com/2006090173928420.html - Vendor Advisory, URL Repurposed () http://www.digitalarmaments.com/2006090173928420.html - Vendor Advisory, URL Repurposed
References () http://www.redhat.com/support/errata/RHSA-2006-0179.html - Patch, Vendor Advisory () http://www.redhat.com/support/errata/RHSA-2006-0179.html - Patch, Vendor Advisory
References () http://www.rudedog.org/auth_ldap/Changes.html - () http://www.rudedog.org/auth_ldap/Changes.html -
References () http://www.securityfocus.com/archive/1/421286/100/0/threaded - () http://www.securityfocus.com/archive/1/421286/100/0/threaded -
References () http://www.securityfocus.com/bid/16177 - Patch () http://www.securityfocus.com/bid/16177 - Patch
References () http://www.vupen.com/english/advisories/2006/0117 - Vendor Advisory () http://www.vupen.com/english/advisories/2006/0117 - Vendor Advisory
References () http://wwwnew.mandriva.com/security/advisories?name=MDKSA-2006:017 - Patch, Vendor Advisory () http://wwwnew.mandriva.com/security/advisories?name=MDKSA-2006:017 - Patch, Vendor Advisory
References () https://exchange.xforce.ibmcloud.com/vulnerabilities/24030 - () https://exchange.xforce.ibmcloud.com/vulnerabilities/24030 -

14 Feb 2024, 01:17

Type Values Removed Values Added
References (MISC) http://www.digitalarmaments.com/2006090173928420.html - Vendor Advisory (MISC) http://www.digitalarmaments.com/2006090173928420.html - Vendor Advisory, URL Repurposed

Information

Published : 2006-01-09 23:03

Updated : 2024-11-21 00:05


NVD link : CVE-2006-0150

Mitre link : CVE-2006-0150

CVE.ORG link : CVE-2006-0150


JSON object : View

Products Affected

dave_carrigan

  • auth_ldap
CWE
CWE-134

Use of Externally-Controlled Format String