OpenLDAP vulnerabilities

2011-03-3100:00:00

ubuntu.com

6.8 Medium

CVSS2

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:M/Au:N/C:P/I:P/A:P

9.8 High

AI Score

Confidence

High

0.048 Low

EPSS

Percentile

92.8%

JSON

Releases

Ubuntu 10.10
Ubuntu 10.04
Ubuntu 9.10
Ubuntu 8.04

Packages

openldap - OpenLDAP utilities
openldap2.3 - OpenLDAP utilities

Details

It was discovered that OpenLDAP did not properly check forwarded
authentication failures when using a consumer server and chain overlay. If
OpenLDAP were configured in this manner, an attacker could bypass
authentication checks by sending an invalid password to a consumer server.
(CVE-2011-1024)

It was discovered that OpenLDAP did not properly perform authentication
checks to the rootdn when using the back-ndb backend. An attacker could
exploit this to access the directory by sending an arbitrary password.
Ubuntu does not ship OpenLDAP with back-ndb support by default. This issue
did not affect Ubuntu 8.04 LTS. (CVE-2011-1025)

It was discovered that OpenLDAP did not properly validate modrdn requests.
An unauthenticated remote user could use this to cause a denial of service
via application crash. (CVE-2011-1081)

OSVersionArchitecturePackageVersionFilename
Ubuntu9.10noarchslapd< 2.4.18-0ubuntu1.2UNKNOWN
Ubuntu9.10noarchldap-utils< 2.4.18-0ubuntu1.2UNKNOWN
Ubuntu9.10noarchlibldap-2.4-2< 2.4.18-0ubuntu1.2UNKNOWN
Ubuntu9.10noarchlibldap-2.4-2-dbg< 2.4.18-0ubuntu1.2UNKNOWN
Ubuntu9.10noarchlibldap2-dev< 2.4.18-0ubuntu1.2UNKNOWN
Ubuntu9.10noarchslapd-dbg< 2.4.18-0ubuntu1.2UNKNOWN
Ubuntu8.04noarchslapd< 2.4.9-0ubuntu0.8.04.5UNKNOWN
Ubuntu8.04noarchldap-utils< 2.4.9-0ubuntu0.8.04.5UNKNOWN
Ubuntu8.04noarchlibldap-2.4-2< 2.4.9-0ubuntu0.8.04.5UNKNOWN
Ubuntu8.04noarchlibldap-2.4-2-dbg< 2.4.9-0ubuntu0.8.04.5UNKNOWN

OS	Version	Architecture	Package	Version	Filename
Ubuntu	9.10	noarch	slapd	< 2.4.18-0ubuntu1.2	UNKNOWN
Ubuntu	9.10	noarch	ldap-utils	< 2.4.18-0ubuntu1.2	UNKNOWN
Ubuntu	9.10	noarch	libldap-2.4-2	< 2.4.18-0ubuntu1.2	UNKNOWN
Ubuntu	9.10	noarch	libldap-2.4-2-dbg	< 2.4.18-0ubuntu1.2	UNKNOWN
Ubuntu	9.10	noarch	libldap2-dev	< 2.4.18-0ubuntu1.2	UNKNOWN
Ubuntu	9.10	noarch	slapd-dbg	< 2.4.18-0ubuntu1.2	UNKNOWN
Ubuntu	8.04	noarch	slapd	< 2.4.9-0ubuntu0.8.04.5	UNKNOWN
Ubuntu	8.04	noarch	ldap-utils	< 2.4.9-0ubuntu0.8.04.5	UNKNOWN
Ubuntu	8.04	noarch	libldap-2.4-2	< 2.4.9-0ubuntu0.8.04.5	UNKNOWN
Ubuntu	8.04	noarch	libldap-2.4-2-dbg	< 2.4.9-0ubuntu0.8.04.5	UNKNOWN