Red Hat Security AdvisoryRHSA-2011:0347
openldap security update
Released 2011-03-10 · Red Hat rating Moderate · View on Red Hat →
Fixed in
- Red Hat Enterprise Linux Desktop (v. 6) compat-openldap-2.4.19_2.3.43-15.el6_0.2, openldap-2.4.19-15.el6_0.2, openldap-clients-2.4.19-15.el6_0.2
- Red Hat Enterprise Linux Desktop Optional (v. 6) openldap-2.4.19-15.el6_0.2, openldap-devel-2.4.19-15.el6_0.2, openldap-servers-2.4.19-15.el6_0.2 +1
- Red Hat Enterprise Linux HPC Node (v. 6) compat-openldap-2.4.19_2.3.43-15.el6_0.2, openldap-2.4.19-15.el6_0.2
- Red Hat Enterprise Linux HPC Node Optional (v. 6) openldap-2.4.19-15.el6_0.2, openldap-clients-2.4.19-15.el6_0.2, openldap-devel-2.4.19-15.el6_0.2 +2
- Red Hat Enterprise Linux Server (v. 6) compat-openldap-2.4.19_2.3.43-15.el6_0.2, compat-openldap-2.4.19_2.3.43-15.el6_0.2.ppc, openldap-2.4.19-15.el6_0.2 +5
- Red Hat Enterprise Linux Server Optional (v. 6) openldap-2.4.19-15.el6_0.2, openldap-servers-sql-2.4.19-15.el6_0.2
- Red Hat Enterprise Linux Workstation (v. 6) compat-openldap-2.4.19_2.3.43-15.el6_0.2, openldap-2.4.19-15.el6_0.2, openldap-clients-2.4.19-15.el6_0.2 +2
- Red Hat Enterprise Linux Workstation Optional (v. 6) openldap-2.4.19-15.el6_0.2, openldap-servers-sql-2.4.19-15.el6_0.2
Fixes 3 records
Priority LOW 38
modrdn.c in slapd in OpenLDAP 2.4.x before 2.4.24 allows remote attackers to cause a denial of service (daemon crash) via a relative Distinguished Name (DN) modification request (aka MODRDN operation) that contains an em…
CVSS 2.0MEDIUM 5.0· Network · No auth · Interaction — · EPSS 0.14474 · Published 2011-03-20 · Fixed CWE-399
Priority LOW 37
bind.cpp in back-ndb in OpenLDAP 2.4.x before 2.4.24 does not require authentication for the root Distinguished Name (DN), which allows remote attackers to bypass intended access restrictions via an arbitrary password.
CVSS 2.0MEDIUM 6.8· Network · No auth · Interaction — · EPSS 0.03874 · Published 2011-03-20 · Fixed CWE-287
Priority LOW 26
chain.c in back-ldap in OpenLDAP 2.4.x before 2.4.24, when a master-slave configuration with a chain overlay and ppolicy_forward_updates (aka authentication-failure forwarding) is used, allows remote authenticated users…
CVSS 2.0MEDIUM 4.6· Network · Low privileges · Interaction — · EPSS 0.02593 · Published 2011-03-20 · Fixed CWE-264
THREATIST.IORead the docs