CVE-2011-1025: Medium severity red hat openldap servers vulnerability
bind.cpp in back-ndb in OpenLDAP 2.4.x before 2.4.24 does not require authentication for the root Distinguished Name (DN), which allows remote attackers to bypass intended access restrictions via an arbitrary password.
Other sources
It was reported [1],[2] that OpenLDAP, when using the back-ndb backend (which uses MySQL's NDB cluster engine for the backend storage), would allow successful authentication to the root DN regardless of whether the correct password was provided. In order for this to be successfully exploited, the attacker would need to know the root DN (e.g. cn=root,dc=example,dc=com) to authenticate with.
The back-ndb backend was introduced in OpenLDAP 2.4.12; earlier versions do not have this backend and are thus not vulnerable to this flaw.
References:
[1] http://www.openldap.org/its/index.cgi/Software%20Bugs?id=6661 [2] http://secunia.com/advisories/43331/ [3] http://www.openldap.org/devel/cvsweb.cgi/servers/slapd/back-ndb/bind.cpp.diff?r1=1.5&r2=1.8
— Red Hat
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2011-1025?
CVE-2011-1025 is classified as a high severity vulnerability due to its ability to allow unauthenticated access to the root DN.
How do I fix CVE-2011-1025?
To fix CVE-2011-1025, upgrade OpenLDAP to version 2.4.24 or later where the vulnerability has been addressed.
What versions of OpenLDAP are affected by CVE-2011-1025?
CVE-2011-1025 affects OpenLDAP versions 2.4.6 through 2.4.23.
What kind of attacks can exploit CVE-2011-1025?
Exploiters can use CVE-2011-1025 to bypass access control mechanisms and gain unauthorized access to sensitive LDAP information.
Is authentication required for the root DN in CVE-2011-1025?
No, CVE-2011-1025 does not require authentication for the root DN, making it vulnerable to unauthorized access.