Multiple vulnerabilities in OpenLDAP



Published: 2011-03-20 | Updated: 2020-08-11
Risk Medium
Patch available YES
Number of vulnerabilities 3
CVE-ID CVE-2011-1081
CVE-2011-1024
CVE-2011-1025
CWE-ID CWE-399
CWE-264
CWE-287
Exploitation vector Network
Public exploit Public exploit code for vulnerability #1 is available.
Vulnerable software
Subscribe
OpenLDAP
Server applications / Directory software, identity management

Vendor OpenLDAP.org

Security Bulletin

This security bulletin contains information about 3 vulnerabilities.

1) Resource management error

EUVDB-ID: #VU45182

Risk: Medium

CVSSv3.1:

CVE-ID: CVE-2011-1081

CWE-ID: CWE-399 - Resource Management Errors

Exploit availability: Yes

Description

The vulnerability allows a remote non-authenticated attacker to perform service disruption.

modrdn.c in slapd in OpenLDAP 2.4.x before 2.4.24 allows remote attackers to cause a denial of service (daemon crash) via a relative Distinguished Name (DN) modification request (aka MODRDN operation) that contains an empty value for the OldDN field.

Mitigation

Install update from vendor's website.

Vulnerable software versions

OpenLDAP: 2.4.6 - 2.4.23


CPE2.3 External links

http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10705
http://openwall.com/lists/oss-security/2011/02/28/1
http://openwall.com/lists/oss-security/2011/02/28/2
http://openwall.com/lists/oss-security/2011/03/01/11
http://openwall.com/lists/oss-security/2011/03/01/15
http://secunia.com/advisories/43331
http://secunia.com/advisories/43718
http://security.gentoo.org/glsa/glsa-201406-36.xml
http://securitytracker.com/id?1025191
http://www.mandriva.com/security/advisories?name=MDVSA-2011:055
http://www.mandriva.com/security/advisories?name=MDVSA-2011:056
http://www.openldap.org/devel/cvsweb.cgi/servers/slapd/modrdn.c.diff?r1=1.170.2.8&r2=1.170.2.9
http://www.openldap.org/its/index.cgi/Software%20Bugs?id=6768
http://www.openldap.org/lists/openldap-announce/201102/msg00000.html
http://www.redhat.com/support/errata/RHSA-2011-0347.html
http://www.ubuntu.com/usn/USN-1100-1
http://www.vupen.com/english/advisories/2011/0665
http://bugzilla.novell.com/show_bug.cgi?id=674985
http://bugzilla.redhat.com/show_bug.cgi?id=680975
http://exchange.xforce.ibmcloud.com/vulnerabilities/66239

Q & A

Can this vulnerability be exploited remotely?

How the attacker can exploit this vulnerability?

Is there known malware, which exploits this vulnerability?

2) Permissions, Privileges, and Access Controls

EUVDB-ID: #VU45194

Risk: Low

CVSSv3.1:

CVE-ID: CVE-2011-1024

CWE-ID: CWE-264 - Permissions, Privileges, and Access Controls

Exploit availability: No

Description

The vulnerability allows a remote #AU# to read and manipulate data.

chain.c in back-ldap in OpenLDAP 2.4.x before 2.4.24, when a master-slave configuration with a chain overlay and ppolicy_forward_updates (aka authentication-failure forwarding) is used, allows remote authenticated users to bypass external-program authentication by sending an invalid password to a slave server.

Mitigation

Install update from vendor's website.

Vulnerable software versions

OpenLDAP: 2.4.6 - 2.4.23


CPE2.3 External links

http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10705
http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10735
http://openwall.com/lists/oss-security/2011/02/24/12
http://openwall.com/lists/oss-security/2011/02/25/13
http://secunia.com/advisories/43331
http://secunia.com/advisories/43708
http://secunia.com/advisories/43718
http://security.gentoo.org/glsa/glsa-201406-36.xml
http://securitytracker.com/id?1025188
http://www.mandriva.com/security/advisories?name=MDVSA-2011:055
http://www.mandriva.com/security/advisories?name=MDVSA-2011:056
http://www.openldap.org/devel/cvsweb.cgi/servers/slapd/back-ldap/chain.c.diff?r1=1.76&r2=1.77&hideattic=1&sortbydate=0
http://www.openldap.org/its/index.cgi/Software%20Bugs?id=6607
http://www.openldap.org/lists/openldap-announce/201102/msg00000.html
http://www.openldap.org/lists/openldap-technical/201004/msg00247.html
http://www.redhat.com/support/errata/RHSA-2011-0346.html
http://www.redhat.com/support/errata/RHSA-2011-0347.html
http://www.ubuntu.com/usn/USN-1100-1
http://www.vupen.com/english/advisories/2011/0665
http://bugzilla.novell.com/show_bug.cgi?id=674985
http://bugzilla.redhat.com/show_bug.cgi?id=680466

Q & A

Can this vulnerability be exploited remotely?

How the attacker can exploit this vulnerability?

Is there known malware, which exploits this vulnerability?

3) Improper Authentication

EUVDB-ID: #VU45195

Risk: Medium

CVSSv3.1:

CVE-ID: CVE-2011-1025

CWE-ID: CWE-287 - Improper Authentication

Exploit availability: No

Description

The vulnerability allows a remote non-authenticated attacker to read and manipulate data.

bind.cpp in back-ndb in OpenLDAP 2.4.x before 2.4.24 does not require authentication for the root Distinguished Name (DN), which allows remote attackers to bypass intended access restrictions via an arbitrary password.

Mitigation

Install update from vendor's website.

Vulnerable software versions

OpenLDAP: 2.4.6 - 2.4.23


CPE2.3 External links

http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10705
http://openwall.com/lists/oss-security/2011/02/24/12
http://openwall.com/lists/oss-security/2011/02/25/13
http://secunia.com/advisories/43331
http://secunia.com/advisories/43718
http://security.gentoo.org/glsa/glsa-201406-36.xml
http://securitytracker.com/id?1025190
http://www.mandriva.com/security/advisories?name=MDVSA-2011:056
http://www.openldap.org/devel/cvsweb.cgi/servers/slapd/back-ndb/bind.cpp.diff?r1=1.5&r2=1.8
http://www.openldap.org/its/index.cgi/Software%20Bugs?id=6661
http://www.openldap.org/lists/openldap-announce/201102/msg00000.html
http://www.redhat.com/support/errata/RHSA-2011-0347.html
http://www.ubuntu.com/usn/USN-1100-1
http://www.vupen.com/english/advisories/2011/0665
http://bugzilla.redhat.com/show_bug.cgi?id=680472

Q & A

Can this vulnerability be exploited remotely?

How the attacker can exploit this vulnerability?

Is there known malware, which exploits this vulnerability?



###SIDEBAR###