CVE-2010-0015

Description

nis/nss_nis/nis-pwd.c in the GNU C Library (aka glibc or libc6) 2.7 and Embedded GLIBC (EGLIBC) 2.10.2 adds information from the passwd.adjunct.byname map to entries in the passwd map, which allows remote attackers to obtain the encrypted passwords of NIS accounts by calling the getpwnam function.

References

https://lists.opensuse.org/opensuse-security-announce/2010-10/msg00007.html

http://www.openwall.com/lists/oss-security/2010/01/11/6

http://www.openwall.com/lists/oss-security/2010/01/08/2

http://www.openwall.com/lists/oss-security/2010/01/08/1

http://www.openwall.com/lists/oss-security/2010/01/07/3

http://www.mandriva.com/security/advisories?name=MDVSA-2010:112

http://www.mandriva.com/security/advisories?name=MDVSA-2010:111

http://svn.debian.org/viewsvn/pkg-glibc/glibc-package/trunk/debian/patches/any/submitted-nis-shadow.diff?revision=4062&view=markup

http://sourceware.org/bugzilla/show_bug.cgi?id=11134

http://marc.info/?l=oss-security&m=126320570505651&w=2

http://marc.info/?l=oss-security&m=126320356003425&w=2

http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=560333

Details

Source: Mitre, NVD

Risk Information

CVSS v2

CVSS v3