VulnerabilityModified
CVE-2011-1025
bind.cpp in back-ndb in OpenLDAP 2.4.x before 2.4.24 does not require authentication for the root Distinguished Name (DN), which allows remote attackers to bypass intended access restrictions via an arbitrary password.
MEDIUM 6.8EPSS 3.87%
Does this matter?
Lower severity and a low EPSS score (3.87%). Track it; it rarely justifies an emergency change on its own.
Description
bind.cpp in back-ndb in OpenLDAP 2.4.x before 2.4.24 does not require authentication for the root Distinguished Name (DN), which allows remote attackers to bypass intended access restrictions via an arbitrary password.
- CVSS 2.0
- 6.8 MEDIUMAV:N/AC:M/Au:N/C:P/I:P/A:P
- EPSS
- 3.87% probability · 90th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-287
- Affected
- openldap/openldap
- Source
- secalert@redhat.com
References
- http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10705
- http://openwall.com/lists/oss-security/2011/02/24/12
- http://openwall.com/lists/oss-security/2011/02/25/13
- http://secunia.com/advisories/43331Vendor Advisory
- http://secunia.com/advisories/43718
- http://security.gentoo.org/glsa/glsa-201406-36.xml
- http://securitytracker.com/id?1025190
- http://www.mandriva.com/security/advisories?name=MDVSA-2011:056
- http://www.openldap.org/devel/cvsweb.cgi/servers/slapd/back-ndb/bind.cpp.diff?r1=1.5&r2=1.8Patch
- http://www.openldap.org/its/index.cgi/Software%20Bugs?id=6661
- http://www.openldap.org/lists/openldap-announce/201102/msg00000.html
- http://www.redhat.com/support/errata/RHSA-2011-0347.html
- http://www.ubuntu.com/usn/USN-1100-1
- http://www.vupen.com/english/advisories/2011/0665Vendor Advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=680472Patch
- http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10705
- http://openwall.com/lists/oss-security/2011/02/24/12
- http://openwall.com/lists/oss-security/2011/02/25/13
- http://secunia.com/advisories/43331Vendor Advisory
- http://secunia.com/advisories/43718
- http://security.gentoo.org/glsa/glsa-201406-36.xml
- http://securitytracker.com/id?1025190
- http://www.mandriva.com/security/advisories?name=MDVSA-2011:056
- http://www.openldap.org/devel/cvsweb.cgi/servers/slapd/back-ndb/bind.cpp.diff?r1=1.5&r2=1.8Patch
- http://www.openldap.org/its/index.cgi/Software%20Bugs?id=6661
- http://www.openldap.org/lists/openldap-announce/201102/msg00000.html
- http://www.redhat.com/support/errata/RHSA-2011-0347.html
- http://www.ubuntu.com/usn/USN-1100-1
- http://www.vupen.com/english/advisories/2011/0665Vendor Advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=680472Patch
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.