Detections
Analytics
FreeBSD : ldapscripts -- Command Line User Credentials Disclosure (3a81017a-8154-11dc-9283-0016179b2dd5)
low Nessus Plugin ID 27550
Synopsis
The remote FreeBSD host is missing a security-related update.Description
Ganael Laplanche reports :Up to now, each ldap* command was called with the -w parameter, which allows to specify the bind password on the command line.
Unfortunately, this could make the password appear to anybody performing a `ps` during the call. This is now avoided by using the -y parameter and a password file.
Solution
Update the affected package.See Also
Plugin Details
Severity: Low
ID: 27550
File Name: freebsd_pkg_3a81017a815411dc92830016179b2dd5.nasl
Version: 1.13
Type: local
Family: FreeBSD Local Security Checks
Published: 10/25/2007
Updated: 1/6/2021
Supported Sensors: Nessus
Risk Information
VPR
Risk Factor: Medium
Score: 5.5
CVSS v2
Risk Factor: Low
Base Score: 2.1
Vector: CVSS2#AV:L/AC:L/Au:N/C:P/I:N/A:N
Vulnerability Information
CPE: p-cpe:/a:freebsd:freebsd:ldapscripts, cpe:/o:freebsd:freebsd
Required KB Items: Host/local_checks_enabled, Host/FreeBSD/release, Host/FreeBSD/pkg_info
Patch Publication Date: 10/23/2007
Vulnerability Publication Date: 10/9/2007
Reference Information
CVE: CVE-2007-5373