OpenLDAP Authentication Bypass Vulnerability in Versions Prior to 2.4.25-1
Summary
DEBIAN-CVE-2011-1024: chain.c in back-ldap in OpenLDAP 2.4.x before 2.4.24, when a master-slave configuration with a chain overlay and ppolicy_forward_updates (aka authentication-failure forwarding) is used, allows remote authenticated users... Affects openldap versions < 2.4.25-1. Fixed in 2.4.25-1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
OpenLDAP is an open-source implementation of the Lightweight Directory Access Protocol (LDAP), which is used for accessing and maintaining distributed directory information services. It is widely utilized in various applications for user authentication and directory services. The vulnerability in question affects OpenLDAP versions 2.4.x prior to 2.4.25-1, specifically in configurations using a master-slave setup with a chain overlay and ppolicy_forward_updates.
Vulnerability Detail
The vulnerability arises from a flaw in the chain.c file within the back-ldap component of OpenLDAP. When configured with a chain overlay and ppolicy_forward_updates, remote authenticated users can exploit this flaw to bypass external-program authentication by sending an invalid password to a slave server. This could lead to unauthorized access and potential data breaches, as the authentication mechanism can be circumvented.
How To Fix
Minimum fixed version
2.4.25-1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade openldapTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, consider disabling the chain overlay or the ppolicy_forward_updates feature until the package can be updated to the patched version. This can be done by modifying the OpenLDAP configuration files to remove or comment out the relevant directives.
Conclusion
The OpenLDAP vulnerability identified as CVE-2011-1024 poses a significant risk by allowing authenticated users to bypass authentication. It is crucial to update to version 2.4.25-1 or later to mitigate this risk. Temporary workarounds can be employed until the update is feasible.
See every vulnerability recorded for openldap →
FAQ
The vulnerability allows remote authenticated users to bypass authentication mechanisms, potentially leading to unauthorized access to sensitive data.
You can check your OpenLDAP version by running 'ldapsearch -VV' in the terminal. If your version is below 2.4.25-1, it is affected.
Yes, you can use Vulert, which monitors open-source vulnerabilities in your software using a manifest file like package-lock.json. You can check your application for vulnerabilities in real-time without any installation.
If immediate updating is not possible, consider disabling the vulnerable features as a temporary measure until you can apply the necessary updates.
Detailed information about this vulnerability can be found in the Debian CVE database and other security advisories related to OpenLDAP.
References
Related vulnerabilities
Recent vulnerabilities recorded for openldap.
