CVE-2014-3999

First published: Mon Jun 16 2014(Updated: )

Matthew Daley reported an issue in Horde LDAP where, if a user knew the LDAP bind user's DN, they could login without supplying a password. This has been fixed in version 2.0.6: <a href="https://github.com/horde/horde/commit/8f719b53b0ee2d4b8a40a770430683c98fb5f2fd">https://github.com/horde/horde/commit/8f719b53b0ee2d4b8a40a770430683c98fb5f2fd</a> <a href="https://github.com/horde/horde/commit/4c3e18f1724ab39bfef10c189a5b52036a744d55">https://github.com/horde/horde/commit/4c3e18f1724ab39bfef10c189a5b52036a744d55</a> It has been fixed in Fedora via <a class="bz_bug_link bz_status_CLOSED bz_closed bz_public " title="CLOSED ERRATA - stricter checking for bind()'s with empty passwords" href="show_bug.cgi?id=1104961">bug 1104961</a>, and EPEL 6 via <a class="bz_bug_link bz_status_CLOSED bz_closed bz_public " title="CLOSED ERRATA - stricter checking for bind()'s with empty passwords" href="show_bug.cgi?id=1104962">bug 1104962</a>. Full details available in <a href="http://seclists.org/oss-sec/2014/q2/504">http://seclists.org/oss-sec/2014/q2/504</a>

Credit: cve@mitre.org

Never miss a vulnerability like this again

Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.

Read MoreStart Free Trial

• collector/redhat-bugzilla
• alias/CVE-2014-3999
• collector/nvd-index
• agent/severity
• agent/weakness
• agent/references
• agent/author
• agent/tags
• agent/description
• agent/event
• agent/type
• agent/remedy
• agent/last-modified-date
• agent/softwarecombine
• agent/first-publish-date
• vendor/horde
• canonical/horde horde ldap