OpenLDAP - Denial of Service and Unauthorized Access Vulnerabilities
Summary
DSA-3209-1: openldap - security update. Affects openldap versions < 2.4.31-2. Fixed in 2.4.31-2. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
OpenLDAP is a free implementation of the Lightweight Directory Access Protocol (LDAP), which provides a directory service for managing and accessing distributed directory information. It is commonly used for centralized user authentication and authorization in various applications and systems. However, multiple vulnerabilities have been discovered in OpenLDAP that could potentially lead to denial of service attacks and unauthorized access to resources.
Vulnerability Detail
The first vulnerability (CVE-2013-4449) allows an attacker to crash the OpenLDAP server by unbinding immediately after connecting when the server is configured to use the RWM overlay. This is due to an issue with reference counting. The second vulnerability (CVE-2014-9713) affects the default Debian configuration of the directory database, allowing authenticated users to edit their own attributes and potentially gain unauthorized access to resources. The third vulnerability (CVE-2015-1545) causes the slapd daemon to crash when an empty attribute list is provided in a query while using the deref overlay.
How To Fix
Minimum fixed version
2.4.31-2
This is the first release that contains the fix.
sudo apt-get install --only-upgrade openldapTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
No specific workarounds have been mentioned for these vulnerabilities.
Conclusion
OpenLDAP is susceptible to denial of service and unauthorized access vulnerabilities. It is crucial to upgrade to the patched versions to mitigate these risks. Administrators should also review and modify access control rules if necessary. For further assistance and support in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for openldap →
FAQ
The denial of service vulnerability in OpenLDAP can be exploited by an attacker to crash the server, resulting in a disruption of LDAP services and potential downtime for applications relying on LDAP authentication and authorization.
If LDAP directories are used for access control and user attributes are utilized, an authenticated user can modify their own attributes to gain access to unauthorized resources, potentially bypassing intended access restrictions.
The slapd daemon crashes when an empty attribute list is provided in a query while using the deref overlay. This can be exploited by an attacker to disrupt LDAP services and potentially cause application downtime.
These vulnerabilities are specific to the Debian configuration of OpenLDAP. Other distributions or custom installations may not be affected. However, it is recommended to review the security advisories and apply any relevant patches or updates to ensure the security of your OpenLDAP installation.
No, the new package does not automatically modify existing configurations. Administrators are advised to review the README.Debian file provided with the updated package to manually fix the access control rule for existing databases.
Related vulnerabilities
Recent vulnerabilities recorded for openldap.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
