Executive Summary
| Summary | |
|---|---|
| Title | openldap security and bug fix update |
| Informations | |||
|---|---|---|---|
| Name | RHSA-2011:0346 | First vendor Publication | 2011-03-10 |
| Vendor | RedHat | Last vendor Modification | 2011-03-10 |
| Severity (Vendor) | Moderate | Revision | 01 |
Security-Database Scoring CVSS v3
| Cvss vector : N/A | |||
|---|---|---|---|
| Overall CVSS Score | NA | ||
| Base Score | NA | Environmental Score | NA |
| impact SubScore | NA | Temporal Score | NA |
| Exploitabality Sub Score | NA | ||
| Calculate full CVSS 3.0 Vectors scores | |||
Security-Database Scoring CVSS v2
| Cvss vector : (AV:N/AC:H/Au:S/C:P/I:P/A:P) | |||
|---|---|---|---|
| Cvss Base Score | 4.6 | Attack Range | Network |
| Cvss Impact Score | 6.4 | Attack Complexity | High |
| Cvss Expoit Score | 3.9 | Authentication | Requires single instance |
| Calculate full CVSS 2.0 Vectors scores | |||
Detail
| Problem Description: Updated openldap packages that fix one security issue and one bug are now available for Red Hat Enterprise Linux 5. The Red Hat Security Response Team has rated this update as having moderate security impact. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available from the CVE link in the References section. 2. Relevant releases/architectures: RHEL Desktop Workstation (v. 5 client) - i386, x86_64 Red Hat Enterprise Linux (v. 5 server) - i386, ia64, ppc, s390x, x86_64 Red Hat Enterprise Linux Desktop (v. 5 client) - i386, x86_64 3. Description: OpenLDAP is an open source suite of LDAP (Lightweight Directory Access Protocol) applications and development tools. A flaw was found in the way OpenLDAP handled authentication failures being passed from an OpenLDAP slave to the master. If OpenLDAP was configured with a chain overlay and it forwarded authentication failures, OpenLDAP would bind to the directory as an anonymous user and return success, rather than return failure on the authenticated bind. This could allow a user on a system that uses LDAP for authentication to log into a directory-based account without knowing the password. (CVE-2011-1024) This update also fixes the following bug: * Previously, multiple concurrent connections to an OpenLDAP server could cause the slapd service to terminate unexpectedly with an assertion error. This update adds mutexes to protect multiple threads from accessing a structure with a connection, and the slapd service no longer crashes. (BZ#677611) Users of OpenLDAP should upgrade to these updated packages, which contain backported patches to resolve these issues. After installing this update, the OpenLDAP daemons will be restarted automatically. 4. Solution: Before applying this update, make sure all previously-released errata relevant to your system have been applied. This update is available via the Red Hat Network. Details on how to use the Red Hat Network to apply this update are available at https://access.redhat.com/kb/docs/DOC-11259 5. Bugs fixed (http://bugzilla.redhat.com/): 680466 - CVE-2011-1024 openldap: forwarded bind failure messages cause success |
Original Source
| Url : https://rhn.redhat.com/errata/RHSA-2011-0346.html |
CWE : Common Weakness Enumeration
| % | Id | Name |
|---|---|---|
| 100 % | CWE-264 | Permissions, Privileges, and Access Controls |
OVAL Definitions
| Definition Id: oval:org.mitre.oval:def:21865 | |||
| Oval ID: | oval:org.mitre.oval:def:21865 | ||
| Title: | RHSA-2011:0346: openldap security and bug fix update (Moderate) | ||
| Description: | chain.c in back-ldap in OpenLDAP 2.4.x before 2.4.24, when a master-slave configuration with a chain overlay and ppolicy_forward_updates (aka authentication-failure forwarding) is used, allows remote authenticated users to bypass external-program authentication by sending an invalid password to a slave server. | ||
| Family: | unix | Class: | patch |
| Reference(s): | RHSA-2011:0346-01 CESA-2011:0346 CVE-2011-1024 | Version: | 4 |
| Platform(s): | Red Hat Enterprise Linux 5 CentOS Linux 5 | Product(s): | openldap |
| Definition Synopsis: | |||
| |||
| Definition Id: oval:org.mitre.oval:def:23088 | |||
| Oval ID: | oval:org.mitre.oval:def:23088 | ||
| Title: | ELSA-2011:0346: openldap security and bug fix update (Moderate) | ||
| Description: | chain.c in back-ldap in OpenLDAP 2.4.x before 2.4.24, when a master-slave configuration with a chain overlay and ppolicy_forward_updates (aka authentication-failure forwarding) is used, allows remote authenticated users to bypass external-program authentication by sending an invalid password to a slave server. | ||
| Family: | unix | Class: | patch |
| Reference(s): | ELSA-2011:0346-01 CVE-2011-1024 | Version: | 6 |
| Platform(s): | Oracle Linux 5 | Product(s): | openldap |
| Definition Synopsis: | |||
| |||
| Definition Id: oval:org.mitre.oval:def:27370 | |||
| Oval ID: | oval:org.mitre.oval:def:27370 | ||
| Title: | DEPRECATED: ELSA-2011-0346 -- openldap security and bug fix update (moderate) | ||
| Description: | [2.3.43-12.7] - fix: CVE-2011-1024 ppolicy forwarded bind failure messages cause success (#680484) [2.3.43-12.6] - fix: slapd concurrent access to connections causes slapd to silently die (#677611) | ||
| Family: | unix | Class: | patch |
| Reference(s): | ELSA-2011-0346 CVE-2011-1024 | Version: | 4 |
| Platform(s): | Oracle Linux 5 | Product(s): | openldap |
| Definition Synopsis: | |||
| |||
CPE : Common Platform Enumeration
OpenVAS Exploits
| Date | Description |
|---|---|
| 2012-07-30 | Name : CentOS Update for compat-openldap CESA-2011:0346 centos5 x86_64 File : nvt/gb_CESA-2011_0346_compat-openldap_centos5_x86_64.nasl |
| 2012-06-06 | Name : RedHat Update for openldap RHSA-2011:0347-01 File : nvt/gb_RHSA-2011_0347-01_openldap.nasl |
| 2011-09-27 | Name : Fedora Update for openldap FEDORA-2011-3627 File : nvt/gb_fedora_2011_3627_openldap_fc14.nasl |
| 2011-08-09 | Name : CentOS Update for compat-openldap CESA-2011:0346 centos5 i386 File : nvt/gb_CESA-2011_0346_compat-openldap_centos5_i386.nasl |
| 2011-04-01 | Name : Mandriva Update for openldap MDVSA-2011:055 (openldap) File : nvt/gb_mandriva_MDVSA_2011_055.nasl |
| 2011-04-01 | Name : Mandriva Update for openldap MDVSA-2011:056 (openldap) File : nvt/gb_mandriva_MDVSA_2011_056.nasl |
| 2011-04-01 | Name : Ubuntu Update for openldap, openldap2.3 vulnerabilities USN-1100-1 File : nvt/gb_ubuntu_USN_1100_1.nasl |
| 2011-03-15 | Name : RedHat Update for openldap RHSA-2011:0346-01 File : nvt/gb_RHSA-2011_0346-01_openldap.nasl |
| 2011-03-05 | Name : FreeBSD Ports: openldap-server File : nvt/freebsd_openldap-server2.nasl |
Open Source Vulnerability Database (OSVDB)
| Id | Description |
|---|---|
| 72528 | OpenLDAP back-ldap chain.c Slave Server Invalid Password External-program Aut... |
Nessus® Vulnerability Scanner
| Date | Description |
|---|---|
| 2016-06-22 | Name : The remote OracleVM host is missing one or more security updates. File : oraclevm_OVMSA-2016-0069.nasl - Type : ACT_GATHER_INFO |
| 2014-11-17 | Name : The remote Red Hat host is missing a security update. File : redhat-RHSA-2011-0439.nasl - Type : ACT_GATHER_INFO |
| 2014-07-01 | Name : The remote Gentoo host is missing one or more security-related patches. File : gentoo_GLSA-201406-36.nasl - Type : ACT_GATHER_INFO |
| 2014-06-13 | Name : The remote openSUSE host is missing a security update. File : suse_11_4_openldap2-110304.nasl - Type : ACT_GATHER_INFO |
| 2014-06-13 | Name : The remote openSUSE host is missing a security update. File : suse_11_3_openldap2-110303.nasl - Type : ACT_GATHER_INFO |
| 2013-07-12 | Name : The remote Oracle Linux host is missing one or more security updates. File : oraclelinux_ELSA-2011-0346.nasl - Type : ACT_GATHER_INFO |
| 2013-07-12 | Name : The remote Oracle Linux host is missing one or more security updates. File : oraclelinux_ELSA-2011-0347.nasl - Type : ACT_GATHER_INFO |
| 2012-08-01 | Name : The remote Scientific Linux host is missing one or more security updates. File : sl_20110310_openldap_on_SL5_x.nasl - Type : ACT_GATHER_INFO |
| 2012-08-01 | Name : The remote Scientific Linux host is missing one or more security updates. File : sl_20110310_openldap_on_SL6_x.nasl - Type : ACT_GATHER_INFO |
| 2011-09-26 | Name : The remote Fedora host is missing a security update. File : fedora_2011-3627.nasl - Type : ACT_GATHER_INFO |
| 2011-05-05 | Name : The remote openSUSE host is missing a security update. File : suse_11_2_openldap2-110303.nasl - Type : ACT_GATHER_INFO |
| 2011-04-22 | Name : The remote Fedora host is missing a security update. File : fedora_2011-3612.nasl - Type : ACT_GATHER_INFO |
| 2011-04-19 | Name : The remote SuSE 11 host is missing one or more security updates. File : suse_11_compat-libldap-2_3-0-110303.nasl - Type : ACT_GATHER_INFO |
| 2011-04-15 | Name : The remote CentOS host is missing one or more security updates. File : centos_RHSA-2011-0346.nasl - Type : ACT_GATHER_INFO |
| 2011-04-01 | Name : The remote Ubuntu host is missing one or more security-related patches. File : ubuntu_USN-1100-1.nasl - Type : ACT_GATHER_INFO |
| 2011-03-31 | Name : The remote Mandriva Linux host is missing one or more security updates. File : mandriva_MDVSA-2011-056.nasl - Type : ACT_GATHER_INFO |
| 2011-03-31 | Name : The remote Mandriva Linux host is missing one or more security updates. File : mandriva_MDVSA-2011-055.nasl - Type : ACT_GATHER_INFO |
| 2011-03-11 | Name : The remote host is missing the patch for the advisory RHSA-2011-0347 File : redhat-RHSA-2011-0347.nasl - Type : ACT_GATHER_INFO |
| 2011-03-11 | Name : The remote Red Hat host is missing one or more security updates. File : redhat-RHSA-2011-0346.nasl - Type : ACT_GATHER_INFO |
Alert History
| Date | Informations |
|---|---|
| 2014-02-17 11:54:28 |
|
