OpenLDAP back-ndb Lets Remote Users Authenticate Without a Valid Password

	Keep Track of the Latest Vulnerabilities with SecurityTracker!

SecurityTracker Alert ID: 1025190

SecurityTracker URL: http://securitytracker.com/id/1025190

CVE Reference: CVE-2011-1025 (Links to External Site)

Date: Mar 10 2011

Impact: Host/resource access via network

Fix Available: Yes Vendor Confirmed: Yes

Version(s): 2.4.12 - 2.2.24

Description: A vulnerability was reported in OpenLDAP. A remote user can authenticate without a valid password.

A remote user with knowledge of the target distinguished name can provide an arbitrary password to successfully authenticate on systems using the NDB back-end.

Impact: A remote user can authenticate without a valid password.

Solution: The vendor has issued a fix (2.2.24).

The source code fix is available at:

http://www.openldap.org/devel/cvsweb.cgi/servers/slapd/back-ndb/bind.cpp.diff?r1=1.5&r2=1.8

Vendor URL: www.openldap.org/its/index.cgi/Software Bugs?id=6661 (Links to External Site)

Cause: Authentication error

Underlying OS: Linux (Any), UNIX (Any)

Message History: This archive entry has one or more follow-up message(s) listed below.


[Original Message Not Available for Viewing]