bind.cpp in back-ndb in OpenLDAP 2.4.x before 2.4.24 does not require authentication for the root Distinguished Name (DN), which allows remote attackers to bypass intended access restrictions via an arbitrary password.

The remote host is affected by the vulnerability described in GLSA-201406-36 (OpenLDAP: Multiple vulnerabilities)

    Multiple vulnerabilities have been discovered in OpenLDAP. Please review       the CVE identifiers referenced below for details.
  Impact :

    A remote attacker might employ a specially crafted certificate to       conduct man-in-the-middle attacks on SSL connections made using OpenLDAP,       bypass security restrictions or cause a Denial of Service condition.
  Workaround :

    There is no known workaround at this time.

The remote Oracle Linux 6 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2011-0347 advisory.

    - fix: CVE-2011-1024 ppolicy forwarded bind failure messages cause success

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

A flaw was found in the way OpenLDAP handled authentication failures being passed from an OpenLDAP slave to the master. If OpenLDAP was configured with a chain overlay and it forwarded authentication failures, OpenLDAP would bind to the directory as an anonymous user and return success, rather than return failure on the authenticated bind. This could allow a user on a system that uses LDAP for authentication to log into a directory-based account without knowing the password. (CVE-2011-1024)

It was found that the OpenLDAP back-ndb back end allowed successful authentication to the root distinguished name (DN) when any string was provided as a password. A remote user could use this flaw to access an OpenLDAP directory if they knew the value of the root DN. Note: This issue only affected OpenLDAP installations using the NDB back-end, which is only available for Scientific Linux 6 via third-party software. (CVE-2011-1025)

A flaw was found in the way OpenLDAP handled modify relative distinguished name (modrdn) requests. A remote, unauthenticated user could use this flaw to crash an OpenLDAP server via a modrdn request containing an empty old RDN value. (CVE-2011-1081)

After installing this update, the OpenLDAP daemons will be restarted automatically.

Changes not covered by bugs :

  - removed slurpd options from sysconfig/ldap

    - fix: possible NULL pointer dereference in NSS       implementation

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Three security issues were fixed during the rebase!

Changes not covered by bugs :

  - new: system resource limiting for slapd using ulimit

    - fix: possible NULL pointer dereference in NSS       implementation OpenLDAP package was rebased to 2.4.24.

Extension of API :

  - libldap adds: ldap_destroy ldap_dup     ldap_sasl_interactive_bind

    - libldif adds: ldif_put_wrap ldif_sput_wrap

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Updated openldap packages that fix one security issue and one bug are now available for Red Hat Enterprise Linux 5.

The Red Hat Security Response Team has rated this update as having moderate security impact. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available from the CVE link in the References section.

OpenLDAP is an open source suite of LDAP (Lightweight Directory Access Protocol) applications and development tools.

A flaw was found in the way OpenLDAP handled authentication failures being passed from an OpenLDAP slave to the master. If OpenLDAP was configured with a chain overlay and it forwarded authentication failures, OpenLDAP would bind to the directory as an anonymous user and return success, rather than return failure on the authenticated bind. This could allow a user on a system that uses LDAP for authentication to log into a directory-based account without knowing the password. (CVE-2011-1024)

This update also fixes the following bug :

* Previously, multiple concurrent connections to an OpenLDAP server could cause the slapd service to terminate unexpectedly with an assertion error. This update adds mutexes to protect multiple threads from accessing a structure with a connection, and the slapd service no longer crashes. (BZ#677611)

Users of OpenLDAP should upgrade to these updated packages, which contain backported patches to resolve these issues. After installing this update, the OpenLDAP daemons will be restarted automatically.

It was discovered that OpenLDAP did not properly check forwarded authentication failures when using a slave server and chain overlay.
If OpenLDAP were configured in this manner, an attacker could bypass authentication checks by sending an invalid password to a slave server. (CVE-2011-1024)

It was discovered that OpenLDAP did not properly perform authentication checks to the rootdn when using the back-ndb backend.
An attacker could exploit this to access the directory by sending an arbitrary password. Ubuntu does not ship OpenLDAP with back-ndb support by default. This issue did not affect Ubuntu 8.04 LTS.
(CVE-2011-1025)

It was discovered that OpenLDAP did not properly validate modrdn requests. An unauthenticated remote user could use this to cause a denial of service via application crash. (CVE-2011-1081).

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Multiple vulnerabilities has been identified and fixed in openldap :

chain.c in back-ldap in OpenLDAP 2.4.x before 2.4.24, when a master-slave configuration with a chain overlay and ppolicy_forward_updates (aka authentication-failure forwarding) is used, allows remote authenticated users to bypass external-program authentication by sending an invalid password to a slave server (CVE-2011-1024).

bind.cpp in back-ndb in OpenLDAP 2.4.x before 2.4.24 does not require authentication for the root Distinguished Name (DN), which allows remote attackers to bypass intended access restrictions via an arbitrary password (CVE-2011-1025).

modrdn.c in slapd in OpenLDAP 2.4.x before 2.4.24 allows remote attackers to cause a denial of service (daemon crash) via a relative Distinguished Name (DN) modification request (aka MODRDN operation) that contains an empty value for the OldDN field (CVE-2011-1081).

The updated packages have been patched to correct these issues.

Updated openldap packages that fix three security issues are now available for Red Hat Enterprise Linux 6.

The Red Hat Security Response Team has rated this update as having moderate security impact. Common Vulnerability Scoring System (CVSS) base scores, which give detailed severity ratings, are available for each vulnerability from the CVE links in the References section.

OpenLDAP is an open source suite of LDAP (Lightweight Directory Access Protocol) applications and development tools.

A flaw was found in the way OpenLDAP handled authentication failures being passed from an OpenLDAP slave to the master. If OpenLDAP was configured with a chain overlay and it forwarded authentication failures, OpenLDAP would bind to the directory as an anonymous user and return success, rather than return failure on the authenticated bind. This could allow a user on a system that uses LDAP for authentication to log into a directory-based account without knowing the password. (CVE-2011-1024)

It was found that the OpenLDAP back-ndb back end allowed successful authentication to the root distinguished name (DN) when any string was provided as a password. A remote user could use this flaw to access an OpenLDAP directory if they knew the value of the root DN. Note: This issue only affected OpenLDAP installations using the NDB back-end, which is only available for Red Hat Enterprise Linux 6 via third-party software. (CVE-2011-1025)

A flaw was found in the way OpenLDAP handled modify relative distinguished name (modrdn) requests. A remote, unauthenticated user could use this flaw to crash an OpenLDAP server via a modrdn request containing an empty old RDN value. (CVE-2011-1081)

Users of OpenLDAP should upgrade to these updated packages, which contain backported patches to resolve these issues. After installing this update, the OpenLDAP daemons will be restarted automatically.

ID	Name	Product	Family	Severity
76331	GLSA-201406-36 : OpenLDAP: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	medium
68229	Oracle Linux 6 : openldap (ELSA-2011-0347)	Nessus	Oracle Linux Local Security Checks	critical
60988	Scientific Linux Security Update : openldap on SL6.x i386/x86_64	Nessus	Scientific Linux Local Security Checks	medium
56296	Fedora 14 : openldap-2.4.23-10.fc14 (2011-3627)	Nessus	Fedora Local Security Checks	medium
53516	Fedora 15 : openldap-2.4.24-2.fc15 (2011-3612)	Nessus	Fedora Local Security Checks	medium
53428	CentOS 5 : openldap (CESA-2011:0346)	Nessus	CentOS Local Security Checks	medium
53257	Ubuntu 8.04 LTS / 9.10 / 10.04 LTS / 10.10 : openldap, openldap2.3 vulnerabilities (USN-1100-1)	Nessus	Ubuntu Local Security Checks	medium
53227	Mandriva Linux Security Advisory : openldap (MDVSA-2011:056)	Nessus	Mandriva Local Security Checks	medium
52628	RHEL 6 : openldap (RHSA-2011:0347)	Nessus	Red Hat Local Security Checks	medium
52627	RHEL 5 : openldap (RHSA-2011:0346)	Nessus	Red Hat Local Security Checks	medium

Detections

Analytics

CVE-2011-1025

critical

Tenable Plugins

medium

critical

medium

medium

medium

medium

medium

medium

medium

medium