Bug 680472 (CVE-2011-1025)

Summary: CVE-2011-1025 openldap: rootpw not verified via slapd.conf when using the NDB backend
Product: [Other] Security Response Reporter: Vincent Danen <vdanen>
Component: vulnerabilityAssignee: Red Hat Product Security <security-response-team>
Status: CLOSED ERRATA QA Contact:
Severity: medium Docs Contact:
Priority: medium    
Version: unspecifiedCC: jplans, omoris, rmeggins, vkrizan
Target Milestone: ---Keywords: Security
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard:
Fixed In Version: Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of: Environment:
Last Closed: 2015-07-29 14:02:01 UTC Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Bug Depends On: 680481, 680482, 680483    
Bug Blocks:    

Description Vincent Danen 2011-02-25 17:02:59 UTC
It was reported [1],[2] that OpenLDAP, when using the back-ndb backend (which uses MySQL's NDB cluster engine for the backend storage), would allow successful authentication to the root DN regardless of whether the correct password was provided.  In order for this to be successfully exploited, the attacker would need to know the root DN (e.g. cn=root,dc=example,dc=com) to authenticate with.

The back-ndb backend was introduced in OpenLDAP 2.4.12; earlier versions do not have this backend and are thus not vulnerable to this flaw.

References:

[1] http://www.openldap.org/its/index.cgi/Software%20Bugs?id=6661
[2] http://secunia.com/advisories/43331/
[3] http://www.openldap.org/devel/cvsweb.cgi/servers/slapd/back-ndb/bind.cpp.diff?r1=1.5&r2=1.8

Comment 2 Vincent Danen 2011-02-25 17:35:31 UTC
Created openldap tracking bugs for this issue

Affects: fedora-all [bug 680483]

Comment 4 Jan Vcelak 2011-03-01 12:33:18 UTC
Already fixed in upstream 2.4.24, for Fedora this means:

F16  not affected
F14  affected, but 2.4.24 is waiting in updates testing
F14  affected
F13  affected

Comment 5 Jan Vcelak 2011-03-01 12:42:13 UTC
F13 resolved in: openldap-2.4.21-12.fc13
F14 resolved in: openldap-2.4.23-9.fc14

Comment 6 Vincent Danen 2011-03-03 22:07:06 UTC
The back-ndb backend is only useful if you have installed the MySQL Cluster software, which provides the NDB support.  This support no longer comes with MySQL as provided in Red Hat Enterprise Linux.  In order for this to be exploited, MySQL Cluster must be installed, which is a separate commercial offering from Oracle:

http://dev.mysql.com/doc/refman/5.0/en/mysql-cluster.html

As a result, the security impact of this issue is moderate, because of the additional requirements required to make it feasible; these requirements are not satisfied by any supported packages in Red Hat Enterprise Linux.

Comment 8 errata-xmlrpc 2011-03-10 20:47:25 UTC
This issue has been addressed in following products:

  Red Hat Enterprise Linux 6

Via RHSA-2011:0347 https://rhn.redhat.com/errata/RHSA-2011-0347.html