CVE-2006-5170 in pam_ldap
Summary
by MITRE
pam_ldap in nss_ldap on Red Hat Enterprise Linux 4, Fedora Core 3 and earlier, and possibly other distributions does not return an error condition when an LDAP directory server responds with a PasswordPolicyResponse control response, which causes the pam_authenticate function to return a success code even if authentication has failed, as originally reported for xscreensaver.
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 04/23/2026
The vulnerability described in CVE-2006-5170 represents a critical authentication bypass flaw within the pam_ldap module of the nss_ldap package on various linux distributions including Red Hat Enterprise Linux 4 and Fedora Core 3. This issue stems from the improper handling of LDAP PasswordPolicyResponse controls during the authentication process, creating a scenario where authentication failures are incorrectly reported as successful operations. The flaw specifically affects the pam_authenticate function which fails to properly interpret the server's response when password policy controls are present, leading to a false positive authentication result.
The technical root cause of this vulnerability lies in the pam_ldap module's inability to correctly process LDAP controls, particularly the PasswordPolicyResponse control that is part of the Lightweight Directory Access Protocol standard. When an LDAP server responds with this control during authentication, it typically contains information about password policies, expiration warnings, or other authentication-related status information. The module's failure to recognize and properly handle this control response means that authentication functions return success codes regardless of whether the actual authentication attempt was successful or not. This behavior violates fundamental security principles and creates a dangerous condition where unauthorized access can occur through failed authentication attempts.
From an operational perspective, this vulnerability creates a significant risk for systems relying on LDAP authentication through the pam_ldap module. The impact extends beyond simple authentication failures to potentially allow attackers to bypass authentication mechanisms entirely, particularly when password policy controls are active on the LDAP server. The vulnerability affects systems where xscreensaver or similar applications depend on the nss_ldap module for authentication, making it relevant to desktop environments and enterprise systems that utilize centralized authentication. The flaw essentially allows for a false positive authentication state where the system believes authentication succeeded even when it failed, creating a pathway for unauthorized access and privilege escalation.
This vulnerability aligns with CWE-284 Access Control flaws, specifically addressing improper authentication handling within the PAM framework. The issue also maps to ATT&CK technique T1078 Valid Accounts, as it can enable adversaries to leverage failed authentication attempts to achieve successful access through the corrupted authentication flow. Organizations using affected versions of nss_ldap and pam_ldap modules face the risk of credential compromise and unauthorized system access. The vulnerability demonstrates how seemingly minor control response handling issues can create major security weaknesses in authentication systems, particularly those relying on external directory services.
The recommended mitigations include immediate patching of affected systems with updated versions of the nss_ldap and pam_ldap packages, ensuring that all LDAP authentication modules properly handle PasswordPolicyResponse controls. System administrators should also implement additional monitoring for authentication failures and unusual authentication patterns that might indicate the exploitation of this vulnerability. Organizations should consider implementing layered security controls and additional authentication verification mechanisms to compensate for the potential authentication bypass. Regular security assessments of authentication modules and LDAP configurations should be conducted to identify and remediate similar issues that might exist in other components of the authentication infrastructure.