Scientific Linux Security Update : libuser on SL4.x, SL5.x i386/x86_64
Medium Nessus Plugin ID 60941
SynopsisThe remote Scientific Linux host is missing one or more security updates.
DescriptionIt was discovered that libuser did not set the password entry correctly when creating LDAP (Lightweight Directory Access Protocol) users. If an administrator did not assign a password to an LDAP based user account, either at account creation with luseradd, or with lpasswd after account creation, an attacker could use this flaw to log into that account with a default password string that should have been rejected. (CVE-2011-0002)
Note: LDAP administrators that have used libuser tools to add users should check existing user accounts for plain text passwords, and reset them as necessary.
SolutionUpdate the affected libuser and / or libuser-devel packages.