Bug 680472 (CVE-2011-1025)

Summary:	CVE-2011-1025 openldap: rootpw not verified via slapd.conf when using the NDB backend
Product:	[Other] Security Response	Reporter:	Vincent Danen <vdanen>
Component:	vulnerability	Assignee:	Red Hat Product Security <security-response-team>
Status:	CLOSED ERRATA	QA Contact:
Severity:	medium	Docs Contact:
Priority:	medium
Version:	unspecified	CC:	jplans, omoris, rmeggins, vkrizan
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:		Doc Type:	Bug Fix
Doc Text:		Story Points:	---
Clone Of:		Environment:
Last Closed:	2015-07-29 14:02:01 UTC	Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:	680481, 680482, 680483
Bug Blocks:

Description Vincent Danen 2011-02-25 17:02:59 UTC

It was reported [1],[2] that OpenLDAP, when using the back-ndb backend (which uses MySQL's NDB cluster engine for the backend storage), would allow successful authentication to the root DN regardless of whether the correct password was provided.  In order for this to be successfully exploited, the attacker would need to know the root DN (e.g. cn=root,dc=example,dc=com) to authenticate with.

The back-ndb backend was introduced in OpenLDAP 2.4.12; earlier versions do not have this backend and are thus not vulnerable to this flaw.

References:

[1] http://www.openldap.org/its/index.cgi/Software%20Bugs?id=6661
[2] http://secunia.com/advisories/43331/
[3] http://www.openldap.org/devel/cvsweb.cgi/servers/slapd/back-ndb/bind.cpp.diff?r1=1.5&r2=1.8

Comment 2 Vincent Danen 2011-02-25 17:35:31 UTC

Created openldap tracking bugs for this issue

Affects: fedora-all [bug 680483]

Comment 4 Jan Vcelak 2011-03-01 12:33:18 UTC

Already fixed in upstream 2.4.24, for Fedora this means:

F16  not affected
F14  affected, but 2.4.24 is waiting in updates testing
F14  affected
F13  affected

Comment 5 Jan Vcelak 2011-03-01 12:42:13 UTC

F13 resolved in: openldap-2.4.21-12.fc13
F14 resolved in: openldap-2.4.23-9.fc14

Comment 6 Vincent Danen 2011-03-03 22:07:06 UTC

The back-ndb backend is only useful if you have installed the MySQL Cluster software, which provides the NDB support.  This support no longer comes with MySQL as provided in Red Hat Enterprise Linux.  In order for this to be exploited, MySQL Cluster must be installed, which is a separate commercial offering from Oracle:

http://dev.mysql.com/doc/refman/5.0/en/mysql-cluster.html

As a result, the security impact of this issue is moderate, because of the additional requirements required to make it feasible; these requirements are not satisfied by any supported packages in Red Hat Enterprise Linux.

Comment 8 errata-xmlrpc 2011-03-10 20:47:25 UTC

This issue has been addressed in following products:

  Red Hat Enterprise Linux 6

Via RHSA-2011:0347 https://rhn.redhat.com/errata/RHSA-2011-0347.html