Multiple vulnerabilities in OpenLDAP



| Updated: 2020-08-11
Risk Medium
Patch available YES
Number of vulnerabilities 3
CVE-ID CVE-2011-1081
CVE-2011-1024
CVE-2011-1025
CWE-ID CWE-399
CWE-264
CWE-287
Exploitation vector Network
Public exploit Public exploit code for vulnerability #1 is available.
Vulnerable software
 OpenLDAP
Server applications / Directory software, identity management

Vendor OpenLDAP.org

Security Bulletin

This security bulletin contains information about 3 vulnerabilities.

1) Resource management error

EUVDB-ID: #VU45182

Risk: Medium

CVSSv4.0: 5.5 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P/U:Green]

CVE-ID: CVE-2011-1081

CWE-ID: CWE-399 - Resource Management Errors

Exploit availability: Yes

Description

The vulnerability allows a remote non-authenticated attacker to perform service disruption.

modrdn.c in slapd in OpenLDAP 2.4.x before 2.4.24 allows remote attackers to cause a denial of service (daemon crash) via a relative Distinguished Name (DN) modification request (aka MODRDN operation) that contains an empty value for the OldDN field.

Mitigation

Install update from vendor's website.

Vulnerable software versions

OpenLDAP: 2.4.6 - 2.4.23

CPE2.3 External links

https://kb.juniper.net/InfoCenter/index?page=content&id=JSA10705
https://openwall.com/lists/oss-security/2011/02/28/1
https://openwall.com/lists/oss-security/2011/02/28/2
https://openwall.com/lists/oss-security/2011/03/01/11
https://openwall.com/lists/oss-security/2011/03/01/15
https://secunia.com/advisories/43331
https://secunia.com/advisories/43718
https://security.gentoo.org/glsa/glsa-201406-36.xml
https://securitytracker.com/id?1025191
https://www.mandriva.com/security/advisories?name=MDVSA-2011:055
https://www.mandriva.com/security/advisories?name=MDVSA-2011:056
https://www.openldap.org/devel/cvsweb.cgi/servers/slapd/modrdn.c.diff?r1=1.170.2.8&r2=1.170.2.9
https://www.openldap.org/its/index.cgi/Software%20Bugs?id=6768
https://www.openldap.org/lists/openldap-announce/201102/msg00000.html
https://www.redhat.com/support/errata/RHSA-2011-0347.html
https://www.ubuntu.com/usn/USN-1100-1
https://www.vupen.com/english/advisories/2011/0665
https://bugzilla.novell.com/show_bug.cgi?id=674985
https://bugzilla.redhat.com/show_bug.cgi?id=680975
https://exchange.xforce.ibmcloud.com/vulnerabilities/66239


Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

How the attacker can exploit this vulnerability?

The attacker would have to send a specially crafted request to the affected application in order to exploit this vulnerability.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability. However, proof of concept for this vulnerability is available.

2) Permissions, Privileges, and Access Controls

EUVDB-ID: #VU45194

Risk: Low

CVSSv4.0: 0.5 [CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2011-1024

CWE-ID: CWE-264 - Permissions, Privileges, and Access Controls

Exploit availability: No

Description

The vulnerability allows a remote #AU# to read and manipulate data.

chain.c in back-ldap in OpenLDAP 2.4.x before 2.4.24, when a master-slave configuration with a chain overlay and ppolicy_forward_updates (aka authentication-failure forwarding) is used, allows remote authenticated users to bypass external-program authentication by sending an invalid password to a slave server.

Mitigation

Install update from vendor's website.

Vulnerable software versions

OpenLDAP: 2.4.6 - 2.4.23

CPE2.3 External links

https://kb.juniper.net/InfoCenter/index?page=content&id=JSA10705
https://kb.juniper.net/InfoCenter/index?page=content&id=JSA10735
https://openwall.com/lists/oss-security/2011/02/24/12
https://openwall.com/lists/oss-security/2011/02/25/13
https://secunia.com/advisories/43331
https://secunia.com/advisories/43708
https://secunia.com/advisories/43718
https://security.gentoo.org/glsa/glsa-201406-36.xml
https://securitytracker.com/id?1025188
https://www.mandriva.com/security/advisories?name=MDVSA-2011:055
https://www.mandriva.com/security/advisories?name=MDVSA-2011:056
https://www.openldap.org/devel/cvsweb.cgi/servers/slapd/back-ldap/chain.c.diff?r1=1.76&r2=1.77&hideattic=1&sortbydate=0
https://www.openldap.org/its/index.cgi/Software%20Bugs?id=6607
https://www.openldap.org/lists/openldap-announce/201102/msg00000.html
https://www.openldap.org/lists/openldap-technical/201004/msg00247.html
https://www.redhat.com/support/errata/RHSA-2011-0346.html
https://www.redhat.com/support/errata/RHSA-2011-0347.html
https://www.ubuntu.com/usn/USN-1100-1
https://www.vupen.com/english/advisories/2011/0665
https://bugzilla.novell.com/show_bug.cgi?id=674985
https://bugzilla.redhat.com/show_bug.cgi?id=680466


Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote authenticated privileged user via the Internet.

How the attacker can exploit this vulnerability?

The attacker would have to send a specially crafted request to the affected application in order to exploit this vulnerability.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

3) Improper Authentication

EUVDB-ID: #VU45195

Risk: Medium

CVSSv4.0: 2.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:U/U:Green]

CVE-ID: CVE-2011-1025

CWE-ID: CWE-287 - Improper Authentication

Exploit availability: No

Description

The vulnerability allows a remote non-authenticated attacker to read and manipulate data.

bind.cpp in back-ndb in OpenLDAP 2.4.x before 2.4.24 does not require authentication for the root Distinguished Name (DN), which allows remote attackers to bypass intended access restrictions via an arbitrary password.

Mitigation

Install update from vendor's website.

Vulnerable software versions

OpenLDAP: 2.4.6 - 2.4.23

CPE2.3 External links

https://kb.juniper.net/InfoCenter/index?page=content&id=JSA10705
https://openwall.com/lists/oss-security/2011/02/24/12
https://openwall.com/lists/oss-security/2011/02/25/13
https://secunia.com/advisories/43331
https://secunia.com/advisories/43718
https://security.gentoo.org/glsa/glsa-201406-36.xml
https://securitytracker.com/id?1025190
https://www.mandriva.com/security/advisories?name=MDVSA-2011:056
https://www.openldap.org/devel/cvsweb.cgi/servers/slapd/back-ndb/bind.cpp.diff?r1=1.5&r2=1.8
https://www.openldap.org/its/index.cgi/Software%20Bugs?id=6661
https://www.openldap.org/lists/openldap-announce/201102/msg00000.html
https://www.redhat.com/support/errata/RHSA-2011-0347.html
https://www.ubuntu.com/usn/USN-1100-1
https://www.vupen.com/english/advisories/2011/0665
https://bugzilla.redhat.com/show_bug.cgi?id=680472


Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

How the attacker can exploit this vulnerability?

The attacker would have to send a specially crafted request to the affected application in order to exploit this vulnerability.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.



###SIDEBAR###