CVE-2006-5170: Debian Linux

High severity, CVSS 7.5. EPSS: 4.1% chance of exploitation in the next 30 days.

pam_ldap in nss_ldap on Red Hat Enterprise Linux 4, Fedora Core 3 and earlier, and possibly other distributions does not return an error condition when an LDAP directory server responds with a PasswordPolicyResponse control response, which causes the pam_authenticate function to return a success code even if authentication has failed, as originally reported for xscreensaver.

Affected products

• Debian Debian Linux: version 3.1 only
• Fedoraproject Fedora Core: up to and including core_3.0
• Red Hat Enterprise Linux: version 4.0 only
• Red Hat Enterprise Linux Desktop: version 4.0 only
• Red Hat Enterprise Linux For IBM Z Systems: version 4.0_s390 only; version 4.0_s390x only
• Red Hat Enterprise Linux For Power Big Endian: version 4.0 only
• Red Hat Enterprise Linux Server: version 4.0 only
• Red Hat Enterprise Linux Workstation: version 4.0 only

Published 2006-10-10. Last modified 2026-06-16.