CVE-2003-0174

CriticalCVSS 9.8/10Last modified Jun 16, 2026

Description

The LDAP name service (nsd) in IRIX 6.5.19 and earlier does not properly verify if the USERPASSWORD attribute has been provided by an LDAP server, which could allow attackers to log in without a password.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-346

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

http://www.ciac.org/ciac/bulletins/n-084.shtmlBroken Link
http://www.securityfocus.com/bid/7442Broken Link, Patch, Third Party Advisory, VDB Entry, Vendor Advisory
https://exchange.xforce.ibmcloud.com/vulnerabilities/11860Third Party Advisory, VDB Entry
http://www.ciac.org/ciac/bulletins/n-084.shtmlBroken Link
http://www.securityfocus.com/bid/7442Broken Link, Patch, Third Party Advisory, VDB Entry, Vendor Advisory
https://exchange.xforce.ibmcloud.com/vulnerabilities/11860Third Party Advisory, VDB Entry

Timeline

Published: May 12, 2003
Last modified: Jun 16, 2026
NVD status: Modified

Related CVEs from 2003

CVE-2003-01752.1SGI IRIX before 6.5.21 allows local users to cause a denial of service (kernel panic) via a certain call to the PIOCSWATCH ioctl.CVE-2003-01765.0The Name Service Daemon (nsd), when running on an NIS master on SGI IRIX 6.5.x through 6.5.20f, and possibly earlier versions, allows remote CVE-2003-01774.6SGI IRIX 6.5.x through 6.5.20f, and possibly earlier versions, does not follow "-" entries in the /etc/group file, which may cause subsequen CVE-2003-017810.0Multiple buffer overflows in Lotus Domino Web Server before 6.0.1 allow remote attackers to cause a denial of service or execute arbitrary c CVE-2003-01797.5Buffer overflow in the COM Object Control Handler for Lotus Domino 6.0.1 and earlier allows remote attackers to execute arbitrary code via m CVE-2003-01805.0Lotus Domino Web Server (nhttp.exe) before 6.0.1 allows remote attackers to cause a denial of service via an incomplete POST request, as dem CVE-2003-01815.0Lotus Domino Web Server (nhttp.exe) before 6.0.1 allows remote attackers to cause a denial of service via a "Fictionary Value Field POST req CVE-2003-01875.0The connection tracking core of Netfilter for Linux 2.4.20, with CONFIG_IP_NF_CONNTRACK enabled or the ip_conntrack module loaded, allows re CVE-2003-01887.2lv reads a .lv file from the current working directory, which allows local users to execute arbitrary commands as other lv users by placing CVE-2003-01895.0The authentication module for Apache 2.0.40 through 2.0.45 on Unix does not properly handle threads safely when using the crypt_r or crypt f CVE-2003-01905.0OpenSSH-portable (OpenSSH) 3.6.1p1 and earlier with PAM support enabled immediately sends an error message when a user does not exist, which CVE-2003-01926.4Apache 2 before 2.0.47, and certain versions of mod_ssl for Apache 1.3, do not properly handle "certain sequences of per-directory renegotia