CVE-2011-1024: Medium severity red hat openldap servers vulnerability
chain.c in back-ldap in OpenLDAP 2.4.x before 2.4.24, when a master-slave configuration with a chain overlay and ppolicyforwardupdates (aka authentication-failure forwarding) is used, allows remote authenticated users to bypass external-program authentication by sending an invalid password to a slave server.
Other sources
It was reported [1],[2],[3] that in certain configurations, OpenLDAP would authenticate with an invalid password. If an OpenLDAP slave received an authenticated bind request with an invalid password that was forwarded to the master LDAP server, the LDAP slave would return a successful bind (as an anonymous user) rather than return a failure (as the user to authenticate). This is due to a chain overlay being set on the frontend, with a ppolicy configured with ppolicyforwardupdates. While this is not a security issue regarding LDAP contents, due to the authentication as an unprivileged anonymous user, when LDAP returns a successful bind to other external programs (such as programs performing authentication, such as pamldap or SSSD) it could allow a user to login with an invalid password (in that case, if LDAP is used for user authentication, it could lead to a successful login with an invalid password).
This was already corrected upstream [4] for unrelated reasons.
References:
[1] http://www.openldap.org/its/index.cgi/Software%20Bugs?id=6607 [2] http://www.openldap.org/lists/openldap-technical/201004/msg00247.html [3] http://secunia.com/advisories/43331/ [4] http://www.openldap.org/devel/cvsweb.cgi/servers/slapd/back-ldap/chain.c.diff?r1=1.76&r2=1.77&hideattic=1&sortbydate=0
— Red Hat
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2011-1024?
CVE-2011-1024 has been categorized as having a medium severity due to its potential impact on authentication mechanisms.
How do I fix CVE-2011-1024?
To mitigate CVE-2011-1024, upgrade OpenLDAP to version 2.4.24 or later, where the vulnerability has been resolved.
Which versions of OpenLDAP are affected by CVE-2011-1024?
CVE-2011-1024 affects OpenLDAP versions prior to 2.4.24, including versions 2.4.6 to 2.4.23.
What is the main issue with CVE-2011-1024?
The main issue with CVE-2011-1024 is that it allows remote authenticated users to bypass external-program authentication.
Is CVE-2011-1024 exploitability dependent on configuration?
Yes, CVE-2011-1024's exploitability is contingent on using a master-slave configuration with the chain overlay and ppolicy_forward_updates.