OpenLDAP - Denial of Service Vulnerability
Summary
DSA-3356-1: openldap - security update. Affects openldap versions < 2.4.31-2+deb7u1. Fixed in 2.4.31-2+deb7u1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
OpenLDAP is a free implementation of the Lightweight Directory Access Protocol (LDAP), which provides a directory service for managing and accessing distributed directory information. It is widely used for authentication, authorization, and storing user information. OpenLDAP is a critical component in many systems and applications.
Vulnerability Detail
The OpenLDAP software is vulnerable to a denial of service (DoS) attack due to improper handling of BER (Basic Encoding Rules) data. An attacker can exploit this vulnerability by sending a specially crafted packet to the OpenLDAP server, causing the slapd daemon to crash. This can lead to a complete service disruption, denying legitimate users access to the directory service.
How To Fix
Minimum fixed version
2.4.31-2+deb7u1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade openldapTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability. It is essential to apply the recommended fixes by upgrading the OpenLDAP packages.
Conclusion
The OpenLDAP software is vulnerable to a denial of service (DoS) attack due to improper handling of BER data. It is crucial to upgrade the OpenLDAP packages to the patched versions provided by the respective distributions to mitigate this vulnerability. For further support on vulnerability remediation, contact DevNack.com.
See every vulnerability recorded for openldap →
FAQ
OpenLDAP is a free implementation of the Lightweight Directory Access Protocol (LDAP), used for managing and accessing distributed directory information.
This vulnerability allows an unauthenticated remote attacker to crash the OpenLDAP server, resulting in a denial of service (DoS) and disrupting the directory service.
To fix this vulnerability, upgrade the OpenLDAP packages to the patched versions provided by the respective distributions.
No, there is no known workaround for this vulnerability. It is crucial to apply the recommended fixes by upgrading the OpenLDAP packages.
You can find more information about this vulnerability in the Debian Security Advisory DSA-3356-1.
Related vulnerabilities
Recent vulnerabilities recorded for openldap.
