Details of VAR-200006-0045

ID

VAR-200006-0045

CVE

CVE-2000-0516

TITLE

Shiva Access Manager Globally readable LDAP Password vulnerability

Trust: 0.6

sources: CNNVD: CNNVD-200006-022

DESCRIPTION

When configured to store configuration information in an LDAP directory, Shiva Access Manager 5.0.0 stores the root DN (Distinguished Name) name and password in cleartext in a file that is world readable, which allows local users to compromise the LDAP server. The Shiva Access Manager is a solution for centralized remote access authentication, authorization, and accounting offered by Intel. It runs on Solaris and Windows NT. Shiva Access Manager is vulnerable to a default configuration problem in its Solaris version (and possibly for NT as well, though uncomfirmed). It stores this information in a textfile that is owned by root and set world readable by default, $SHIVA_HOME_DIR/insnmgmt/shiva_access_manager/radtac.ini. This file also contains information such as the LDAP server's hostname and server port. This information can be used to completely compromise the LDAP server

Trust: 1.26

sources: NVD: CVE-2000-0516 // BID: 1329 // VULHUB: VHN-2094

AFFECTED PRODUCTS

vendor:	intel	model:	shiva access manager	scope:	eq	version:	5.0	Trust: 1.6
vendor:	intel	model:	shiva access manager solaris	scope:	eq	version:	5.0	Trust: 0.3

sources: BID: 1329 // CNNVD: CNNVD-200006-022 // NVD: CVE-2000-0516

CVSS

SEVERITY

CVSSV2

CVSSV3

nvd@nist.gov:	CVE-2000-0516
value:	HIGH
Trust: 1.0
CNNVD:	CNNVD-200006-022
value:	HIGH
Trust: 0.6
VULHUB:	VHN-2094
value:	HIGH
Trust: 0.1

nvd@nist.gov:	CVE-2000-0516
severity:	HIGH
baseScore:	7.2
vectorString:	AV:L/AC:L/AU:N/C:C/I:C/A:C
accessVector:	LOCAL
accessComplexity:	LOW
authentication:	NONE
confidentialityImpact:	COMPLETE
integrityImpact:	COMPLETE
availabilityImpact:	COMPLETE
exploitabilityScore:	3.9
impactScore:	10.0
acInsufInfo:	NONE
obtainAllPrivilege:	NONE
obtainUserPrivilege:	NONE
obtainOtherPrivilege:	NONE
userInteractionRequired:	NONE
version:	2.0
Trust: 1.0
VULHUB:	VHN-2094
severity:	HIGH
baseScore:	7.2
vectorString:	AV:L/AC:L/AU:N/C:C/I:C/A:C
accessVector:	LOCAL
accessComplexity:	LOW
authentication:	NONE
confidentialityImpact:	COMPLETE
integrityImpact:	COMPLETE
availabilityImpact:	COMPLETE
exploitabilityScore:	3.9
impactScore:	10.0
acInsufInfo:	NONE
obtainAllPrivilege:	NONE
obtainUserPrivilege:	NONE
obtainOtherPrivilege:	NONE
userInteractionRequired:	NONE
version:	2.0
Trust: 0.1

sources: VULHUB: VHN-2094 // CNNVD: CNNVD-200006-022 // NVD: CVE-2000-0516

PROBLEMTYPE DATA

problemtype:

NVD-CWE-Other

Trust: 1.0

sources: NVD: CVE-2000-0516

THREAT TYPE

local

Trust: 0.9

sources: BID: 1329 // CNNVD: CNNVD-200006-022

TYPE

Configuration Error

Trust: 0.9

sources: BID: 1329 // CNNVD: CNNVD-200006-022

EXPLOIT AVAILABILITY

sources: VULHUB: VHN-2094

EXTERNAL IDS

db:	BID	id:	1329	Trust: 2.0
db:	NVD	id:	CVE-2000-0516	Trust: 1.7
db:	CNNVD	id:	CNNVD-200006-022	Trust: 0.7
db:	BUGTRAQ	id:	20000606 SHIVA ACCESS MANAGER 5.0.0 PLAINTEXT LDAP ROOT PASSWORD.	Trust: 0.6
db:	XF	id:	4612	Trust: 0.6
db:	EXPLOIT-DB	id:	20003	Trust: 0.1
db:	SEEBUG	id:	SSVID-73902	Trust: 0.1
db:	VULHUB	id:	VHN-2094	Trust: 0.1

sources: VULHUB: VHN-2094 // BID: 1329 // CNNVD: CNNVD-200006-022 // NVD: CVE-2000-0516

REFERENCES

url:	http://www.securityfocus.com/bid/1329	Trust: 1.7
url:	http://archives.neohapsis.com/archives/bugtraq/2000-06/0008.html	Trust: 1.7
url:	https://exchange.xforce.ibmcloud.com/vulnerabilities/4612	Trust: 1.1
url:	http://xforce.iss.net/static/4612.php	Trust: 0.6
url:	http://www.shiva.com/remote/radius/	Trust: 0.3

sources: VULHUB: VHN-2094 // BID: 1329 // CNNVD: CNNVD-200006-022 // NVD: CVE-2000-0516

CREDITS

First posted to Bugtraq by Blaise St. Laurent <blaise@geeky.net> on June 6, 2000.

Trust: 0.9

sources: BID: 1329 // CNNVD: CNNVD-200006-022

SOURCES

db:	VULHUB	id:	VHN-2094
db:	BID	id:	1329
db:	CNNVD	id:	CNNVD-200006-022
db:	NVD	id:	CVE-2000-0516

LAST UPDATE DATE

2024-08-14T14:59:35.363000+00:00

SOURCES UPDATE DATE

db:	VULHUB	id:	VHN-2094	date:	2017-10-10T00:00:00
db:	BID	id:	1329	date:	2000-06-06T00:00:00
db:	CNNVD	id:	CNNVD-200006-022	date:	2006-08-09T00:00:00
db:	NVD	id:	CVE-2000-0516	date:	2017-10-10T01:29:10.263

SOURCES RELEASE DATE

db:	VULHUB	id:	VHN-2094	date:	2000-06-06T00:00:00
db:	BID	id:	1329	date:	2000-06-06T00:00:00
db:	CNNVD	id:	CNNVD-200006-022	date:	2000-06-06T00:00:00
db:	NVD	id:	CVE-2000-0516	date:	2000-06-06T04:00:00