Bug 680472 (CVE-2011-1025) - CVE-2011-1025 openldap: rootpw not verified via slapd.conf when using the NDB backend
Summary: CVE-2011-1025 openldap: rootpw not verified via slapd.conf when using the NDB...
Keywords:
Status: CLOSED ERRATA
Alias: CVE-2011-1025
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
medium
medium
Target Milestone: ---
Assignee: Red Hat Product Security
QA Contact:
URL:
Whiteboard: public=20100929,reported=20110224,sou...
Depends On: 680481 680482 680483
Blocks:
TreeView+ depends on / blocked
 
Reported: 2011-02-25 17:02 UTC by Vincent Danen
Modified: 2019-06-08 18:45 UTC (History)
4 users (show)

Fixed In Version:
Doc Type: Bug Fix
Doc Text:
Clone Of:
Environment:
Last Closed: 2015-07-29 14:02:01 UTC


Attachments (Terms of Use)


Links
System ID Priority Status Summary Last Updated
Red Hat Product Errata RHSA-2011:0347 normal SHIPPED_LIVE Moderate: openldap security update 2011-03-10 20:47:17 UTC

Description Vincent Danen 2011-02-25 17:02:59 UTC
It was reported [1],[2] that OpenLDAP, when using the back-ndb backend (which uses MySQL's NDB cluster engine for the backend storage), would allow successful authentication to the root DN regardless of whether the correct password was provided.  In order for this to be successfully exploited, the attacker would need to know the root DN (e.g. cn=root,dc=example,dc=com) to authenticate with.

The back-ndb backend was introduced in OpenLDAP 2.4.12; earlier versions do not have this backend and are thus not vulnerable to this flaw.

References:

[1] http://www.openldap.org/its/index.cgi/Software%20Bugs?id=6661
[2] http://secunia.com/advisories/43331/
[3] http://www.openldap.org/devel/cvsweb.cgi/servers/slapd/back-ndb/bind.cpp.diff?r1=1.5&r2=1.8

Comment 2 Vincent Danen 2011-02-25 17:35:31 UTC
Created openldap tracking bugs for this issue

Affects: fedora-all [bug 680483]

Comment 4 Jan Vcelak 2011-03-01 12:33:18 UTC
Already fixed in upstream 2.4.24, for Fedora this means:

F16  not affected
F14  affected, but 2.4.24 is waiting in updates testing
F14  affected
F13  affected

Comment 5 Jan Vcelak 2011-03-01 12:42:13 UTC
F13 resolved in: openldap-2.4.21-12.fc13
F14 resolved in: openldap-2.4.23-9.fc14

Comment 6 Vincent Danen 2011-03-03 22:07:06 UTC
The back-ndb backend is only useful if you have installed the MySQL Cluster software, which provides the NDB support.  This support no longer comes with MySQL as provided in Red Hat Enterprise Linux.  In order for this to be exploited, MySQL Cluster must be installed, which is a separate commercial offering from Oracle:

http://dev.mysql.com/doc/refman/5.0/en/mysql-cluster.html

As a result, the security impact of this issue is moderate, because of the additional requirements required to make it feasible; these requirements are not satisfied by any supported packages in Red Hat Enterprise Linux.

Comment 8 errata-xmlrpc 2011-03-10 20:47:25 UTC
This issue has been addressed in following products:

  Red Hat Enterprise Linux 6

Via RHSA-2011:0347 https://rhn.redhat.com/errata/RHSA-2011-0347.html


Note You need to log in before you can comment on or make changes to this bug.