PRIOn knowledge basePRION:CVE-2011-1025Authentication flaw
bind.cpp in back-ndb in OpenLDAP 2.4.x before 2.4.24 does not require authentication for the root Distinguished Name (DN), which allows remote attackers to bypass intended access restrictions via an arbitrary password.
References
kb.juniper.net/InfoCenter/index?page=content&id=JSA10705
openwall.com/lists/oss-security/2011/02/24/12
openwall.com/lists/oss-security/2011/02/25/13
secunia.com/advisories/43331
secunia.com/advisories/43718
security.gentoo.org/glsa/glsa-201406-36.xml
securitytracker.com/id?1025190
www.mandriva.com/security/advisories?name=MDVSA-2011:056
www.openldap.org/devel/cvsweb.cgi/servers/slapd/back-ndb/bind.cpp.diff?r1=1.5&r2=1.8
www.openldap.org/its/index.cgi/Software%20Bugs?id=6661
www.openldap.org/lists/openldap-announce/201102/msg00000.html
www.redhat.com/support/errata/RHSA-2011-0347.html
www.ubuntu.com/usn/USN-1100-1
www.vupen.com/english/advisories/2011/0665
bugzilla.redhat.com/show_bug.cgi?id=680472
Related
