Red Hat Bugzilla – Bug 680472
CVE-2011-1025 openldap: rootpw not verified via slapd.conf when using the NDB backend
Last modified: 2015-07-29 10:02:01 EDT
It was reported [1],[2] that OpenLDAP, when using the back-ndb backend (which uses MySQL's NDB cluster engine for the backend storage), would allow successful authentication to the root DN regardless of whether the correct password was provided. In order for this to be successfully exploited, the attacker would need to know the root DN (e.g. cn=root,dc=example,dc=com) to authenticate with. The back-ndb backend was introduced in OpenLDAP 2.4.12; earlier versions do not have this backend and are thus not vulnerable to this flaw. References: [1] http://www.openldap.org/its/index.cgi/Software%20Bugs?id=6661 [2] http://secunia.com/advisories/43331/ [3] http://www.openldap.org/devel/cvsweb.cgi/servers/slapd/back-ndb/bind.cpp.diff?r1=1.5&r2=1.8
Created openldap tracking bugs for this issue Affects: fedora-all [bug 680483]
Already fixed in upstream 2.4.24, for Fedora this means: F16 not affected F14 affected, but 2.4.24 is waiting in updates testing F14 affected F13 affected
F13 resolved in: openldap-2.4.21-12.fc13 F14 resolved in: openldap-2.4.23-9.fc14
The back-ndb backend is only useful if you have installed the MySQL Cluster software, which provides the NDB support. This support no longer comes with MySQL as provided in Red Hat Enterprise Linux. In order for this to be exploited, MySQL Cluster must be installed, which is a separate commercial offering from Oracle: http://dev.mysql.com/doc/refman/5.0/en/mysql-cluster.html As a result, the security impact of this issue is moderate, because of the additional requirements required to make it feasible; these requirements are not satisfied by any supported packages in Red Hat Enterprise Linux.
This issue has been addressed in following products: Red Hat Enterprise Linux 6 Via RHSA-2011:0347 https://rhn.redhat.com/errata/RHSA-2011-0347.html