CVE-2011-1025

OpenLDAP 2.4.x < 2.4.24 - Unauthenticated Improper Authentication via Root DN

Title source: llm
STIX 2.1

Description

bind.cpp in back-ndb in OpenLDAP 2.4.x before 2.4.24 does not require authentication for the root Distinguished Name (DN), which allows remote attackers to bypass intended access restrictions via an arbitrary password.

References (15)

Core 15
Core References
Vendor Advisory vendor-advisory x_refsource_mandriva
http://www.mandriva.com/security/advisories?name=MDVSA-2011:056
Third Party Advisory vendor-advisory x_refsource_gentoo
http://security.gentoo.org/glsa/glsa-201406-36.xml
Third Party Advisory, VDB Entry vdb-entry x_refsource_sectrack
http://securitytracker.com/id?1025190
Various Sources mailing-list x_refsource_mlist
http://www.openldap.org/lists/openldap-announce/201102/msg00000.html
Vendor Advisory vendor-advisory x_refsource_redhat
http://www.redhat.com/support/errata/RHSA-2011-0347.html
Mailing List mailing-list x_refsource_mlist
http://openwall.com/lists/oss-security/2011/02/25/13
Third Party Advisory third-party-advisory x_refsource_secunia
http://secunia.com/advisories/43718
Mailing List mailing-list x_refsource_mlist
http://openwall.com/lists/oss-security/2011/02/24/12
Vendor Advisory vendor-advisory x_refsource_ubuntu
http://www.ubuntu.com/usn/USN-1100-1
Vendor Advisory vdb-entry x_refsource_vupen
http://www.vupen.com/english/advisories/2011/0665
Vendor Advisory third-party-advisory x_refsource_secunia
http://secunia.com/advisories/43331

Scores

EPSS 0.0445
EPSS Percentile 90.2%

Details

CWE
CWE-287
Status published
Products (18)
openldap/openldap 2.4.6
openldap/openldap 2.4.7
openldap/openldap 2.4.8
openldap/openldap 2.4.9
openldap/openldap 2.4.10
openldap/openldap 2.4.11
openldap/openldap 2.4.12
openldap/openldap 2.4.13
openldap/openldap 2.4.14
openldap/openldap 2.4.15
... and 8 more
Published Mar 20, 2011
Tracked Since Feb 18, 2026