CVE-2000-0336: Low severity openldap OpenLDAP vulnerability
Linux OpenLDAP server allows local users to modify arbitrary files via a symlink attack.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Remove
Remove
OpenLDAP (slapd)from your environment.If OpenLDAP is not required on a host, uninstall or disable the slapd service to eliminate the attack surface.
- Configuration
Ensure all directories and files used by OpenLDAP (database, runtime, lock, PID and temporary directories) are owned by the ldap user/group and are not writable by unprivileged or world users; remove any world-writable permissions and replace any unsafe symlinks inside those directories with regular files or secure links.
OpenLDAP (slapd) runtime/database directory permissions = owned by ldap user and not writable by other local users - Compensating control
Restrict local account access on hosts running OpenLDAP: disable or lock untrusted local user accounts, restrict interactive logins, and limit which users can write to the filesystem areas used by slapd (use ACLs, SELinux/AppArmor profiles or container/namespace isolation if available).
- Operational
Scan OpenLDAP data and related system directories for suspicious or unexpected symlinks and for any files modified by local users; restore affected files from trusted backups and investigate for signs of compromise. Rotate any credentials, keys, or secrets that may have been exposed or modified as a result of the exploit.
Event History
Frequently Asked Questions
What is the severity of CVE-2000-0336?
CVE-2000-0336 is considered a high severity vulnerability due to its potential to allow local users to modify arbitrary files.
How do I fix CVE-2000-0336?
To fix CVE-2000-0336, it is recommended to upgrade OpenLDAP to a version that is not affected by this vulnerability.
Which versions of OpenLDAP are affected by CVE-2000-0336?
CVE-2000-0336 affects OpenLDAP versions 1.2.7 to 1.2.10.
What type of attack does CVE-2000-0336 involve?
CVE-2000-0336 involves a symlink attack that allows local users to manipulate file access.
Is CVE-2000-0336 specific to any Linux distribution?
CVE-2000-0336 is known to affect multiple distributions, including Mandrake Linux and Red Hat Linux.