CVE-2010-3282

Name of the Vulnerable Software and Affected Versions 389 Directory Server versions prior to 1.2.7.1 HP-UX Directory Server versions prior to B.08.10.03

Description The issue allows local users to obtain sensitive information by reading the log when audit logging is enabled. This occurs because the Directory Manager password (nsslapd-rootpw) is logged in cleartext when changing cn=config:nsslapd-rootpw.

Recommendations For 389 Directory Server versions prior to 1.2.7.1, update to version 1.2.7.1 or later to resolve the issue. For HP-UX Directory Server versions prior to B.08.10.03, update to version B.08.10.03 or later to resolve the issue. As a temporary workaround, consider disabling audit logging until a patch is available.