#VU19562 Improper Authorization in OpenLDAP


Published: 2019-07-30

Vulnerability identifier: #VU19562

Vulnerability risk: Low

CVSSv3.1: 3.8 [CVSS:3.1/AV:A/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L/E:U/RL:O/RC:C]

CVE-ID: CVE-2019-13565

CWE-ID: CWE-285

Exploitation vector: Local network

Exploit availability: No

Vulnerable software:
OpenLDAP
Server applications / Directory software, identity management

Vendor: OpenLDAP.org

Description

The vulnerability allows a remote attacker to escalate privileges.
The vulnerability exists due to incorrect processing of SASL authentication and session encryption in OpenLDAP. After the first SASL bind is completed, the sasl_ssf value is retained for all new non-SASL connections, allowing to bypass ACLs and obtain access by performing simple binds.

Mitigation
Install updates from vendor's website.

Vulnerable software versions

OpenLDAP: 2.4.3 - 2.4.47

External links
http://www.openldap.org/its/index.cgi/?findid=9052
http://www.openldap.org/lists/openldap-announce/201907/msg00001.html

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote authenticated privileged user via the local network (LAN).

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.


Latest bulletins with this vulnerability


Amazon Linux AMI update for openldap
Multiple vulnerabilities in Oracle Blockchain Platform
Authorization bypass in OpenLDAP in Juniper Junos OS
OpenSUSE Linux update for openldap2
OpenSUSE Linux update for openldap2
Improper authorization in OpenLDAP
Improper Authorization in openldap (Alpine package)