Synopsis: Moderate: libuser security update Issue date: 2011-01-20 CVE Names: CVE-2011-0002 It was discovered that libuser did not set the password entry correctly when creating LDAP (Lightweight Directory Access Protocol) users. If an administrator did not assign a password to an LDAP based user account, either at account creation with luseradd, or with lpasswd after account creation, an attacker could use this flaw to log into that account with a default password string that should have been rejected. (CVE-2011-0002) Note: LDAP administrators that have used libuser tools to add users should check existing user accounts for plain text passwords, and reset them as necessary. SL 4.x SRPMS: libuser-0.52.5-1.1.el4_8.1.src.rpm i386: libuser-0.52.5-1.1.el4_8.1.i386.rpm libuser-devel-0.52.5-1.1.el4_8.1.i386.rpm x86_64: libuser-0.52.5-1.1.el4_8.1.i386.rpm libuser-0.52.5-1.1.el4_8.1.x86_64.rpm libuser-devel-0.52.5-1.1.el4_8.1.x86_64.rpm SL 5.x SRPMS: libuser-0.54.7-2.1.el5_5.2.src.rpm i386: libuser-0.54.7-2.1.el5_5.2.i386.rpm libuser-devel-0.54.7-2.1.el5_5.2.i386.rpm x86_64: libuser-0.54.7-2.1.el5_5.2.i386.rpm libuser-0.54.7-2.1.el5_5.2.x86_64.rpm libuser-devel-0.54.7-2.1.el5_5.2.i386.rpm libuser-devel-0.54.7-2.1.el5_5.2.x86_64.rpm -Connie Sieh -Troy Dawson