An off-by-one error leading to a crash was discovered in openldap 2.4 when processing DNS SRV messages. If slapd was configured to use the dnssrv backend, an attacker could crash the service with crafted DNS responses.

The remote Redhat Enterprise Linux 5 host has one or more packages installed that are affected by multiple vulnerabilities that have been acknowledged by the vendor but will not be patched.

  - openldap-servers: /usr/libexec/openldap/generate-server-cert.sh create world readable password file     (CVE-2016-4984)

  - An off-by-one error leading to a crash was discovered in openldap 2.4 when processing DNS SRV messages. If     slapd was configured to use the dnssrv backend, an attacker could crash the service with crafted DNS     responses. (CVE-2014-8182)

Note that Nessus has not tested for these issues but has instead relied on the package manager's report that the package is installed.

According to the versions of the openldap packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

  - An off-by-one error leading to a crash was discovered     in openldap 2.4 when processing DNS SRV messages. If     slapd was configured to use the dnssrv backend, an     attacker could crash the service with crafted DNS     responses.(CVE-2014-8182)

  - contrib/slapd-modules/nops/nops.c in OpenLDAP through     2.4.45, when both the nops module and the memberof     overlay are enabled, attempts to free a buffer that was     allocated on the stack, which allows remote attackers     to cause a denial of service (slapd crash) via a member     MODDN operation.(CVE-2017-17740)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Updated openldap packages that fix one security issue, several bugs, and add one enhancement are now available for Red Hat Enterprise Linux 7.

Red Hat Product Security has rated this update as having Moderate security impact. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available from the CVE link in the References section.

OpenLDAP is an open source suite of Lightweight Directory Access Protocol (LDAP) applications and development tools. LDAP is a set of protocols used to access and maintain distributed directory information services over an IP network. The openldap packages contain configuration files, libraries, and documentation for OpenLDAP.

A flaw was found in the way OpenLDAP parsed OpenSSL-style cipher strings. As a result, OpenLDAP could potentially use ciphers that were not intended to be enabled. (CVE-2015-3276)

This issue was discovered by Martin Poole of the Red Hat Software Maintenance Engineering group.

The openldap packages have been upgraded to upstream version 2.4.40, which provides a number of bug fixes and one enhancement over the previous version :

* The ORDERING matching rules have been added to the ppolicy attribute type descriptions.

* The server no longer terminates unexpectedly when processing SRV records.

* Missing objectClass information has been added, which enables the user to modify the front-end configuration by standard means.

(BZ#1147982)

This update also fixes the following bugs :

* Previously, OpenLDAP did not properly handle a number of simultaneous updates. As a consequence, sending a number of parallel update requests to the server could cause a deadlock. With this update, a superfluous locking mechanism causing the deadlock has been removed, thus fixing the bug. (BZ#1125152)

* The httpd service sometimes terminated unexpectedly with a segmentation fault on the libldap library unload. The underlying source code has been modified to prevent a bad memory access error that caused the bug to occur. As a result, httpd no longer crashes in this situation. (BZ#1158005)

* After upgrading the system from Red Hat Enterprise Linux 6 to Red Hat Enterprise Linux 7, symbolic links to certain libraries unexpectedly pointed to locations belonging to the openldap-devel package. If the user uninstalled openldap-devel, the symbolic links were broken and the 'rpm -V openldap' command sometimes produced errors. With this update, the symbolic links no longer get broken in the described situation. If the user downgrades openldap to version 2.4.39-6 or earlier, the symbolic links might break. After such downgrade, it is recommended to verify that the symbolic links did not break. To do this, make sure the yum-plugin-verify package is installed and obtain the target libraries by running the 'rpm -V openldap' or 'yum verify openldap' command. (BZ#1230263)

In addition, this update adds the following enhancement :

* OpenLDAP clients now automatically choose the Network Security Services (NSS) default cipher suites for communication with the server. It is no longer necessary to maintain the default cipher suites manually in the OpenLDAP source code. (BZ#1245279)

All openldap users are advised to upgrade to these updated packages, which correct these issues and add this enhancement.

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2015:2131 advisory.

    OpenLDAP is an open-source suite of Lightweight Directory Access Protocol     (LDAP) applications and development tools. LDAP is a set of protocols used     to access and maintain distributed directory information services over an     IP network. The openldap packages contain configuration files, libraries,     and documentation for OpenLDAP.

    A flaw was found in the way OpenLDAP parsed OpenSSL-style cipher strings.
    As a result, OpenLDAP could potentially use ciphers that were not intended     to be enabled. (CVE-2015-3276)

    This issue was discovered by Martin Poole of the Red Hat Software     Maintenance Engineering group.

    The openldap packages have been upgraded to upstream version 2.4.40, which     provides a number of bug fixes and one enhancement over the previous     version:

    * The ORDERING matching rules have been added to the ppolicy attribute type     descriptions.
    * The server no longer terminates unexpectedly when processing SRV records.
    * Missing objectClass information has been added, which enables the user to     modify the front-end configuration by standard means.

    (BZ#1147982)

    This update also fixes the following bugs:

    * Previously, OpenLDAP did not properly handle a number of simultaneous     updates. As a consequence, sending a number of parallel update requests to     the server could cause a deadlock. With this update, a superfluous locking     mechanism causing the deadlock has been removed, thus fixing the bug.
    (BZ#1125152)

    * The httpd service sometimes terminated unexpectedly with a segmentation     fault on the libldap library unload. The underlying source code has been     modified to prevent a bad memory access error that caused the bug to occur.
    As a result, httpd no longer crashes in this situation. (BZ#1158005)

    * After upgrading the system from Red Hat Enterprise Linux 6 to Red Hat     Enterprise Linux 7, symbolic links to certain libraries unexpectedly     pointed to locations belonging to the openldap-devel package. If the user     uninstalled openldap-devel, the symbolic links were broken and the rpm -V     openldap command sometimes produced errors. With this update, the symbolic     links no longer get broken in the described situation. If the user     downgrades openldap to version 2.4.39-6 or earlier, the symbolic links     might break. After such downgrade, it is recommended to verify that the     symbolic links did not break. To do this, make sure the yum-plugin-verify     package is installed and obtain the target libraries by running the rpm -V     openldap or yum verify openldap command. (BZ#1230263)

    In addition, this update adds the following enhancement:

    * OpenLDAP clients now automatically choose the Network Security Services     (NSS) default cipher suites for communication with the server. It is no     longer necessary to maintain the default cipher suites manually in the     OpenLDAP source code. (BZ#1245279)

    All openldap users are advised to upgrade to these updated packages, which     correct these issues and add this enhancement.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
198747	RHEL 5 : openldap (Unpatched Vulnerability)	Nessus	Red Hat Local Security Checks	medium
134003	EulerOS 2.0 SP8 : openldap (EulerOS-SA-2020-1169)	Nessus	Huawei Local Security Checks	high
87132	CentOS 7 : openldap (CESA-2015:2131)	Nessus	CentOS Local Security Checks	high
86970	RHEL 7 : openldap (RHSA-2015:2131)	Nessus	Red Hat Local Security Checks	high

Detections

Analytics

CVE-2014-8182

high

Tenable Plugins

medium

high

high

high