CVE-2014-4668: Medium severity red hat fedora vulnerability
Published Jul 2, 2014
·Updated
The cherokeevalidatorldapcheck function in validatorldap.c in Cherokee 1.2.103 and earlier, when LDAP is used, does not properly consider unauthenticated-bind semantics, which allows remote attackers to bypass authentication via an empty password.
Affected Software
10 affected components
Fedoraproject Fedora=20
Fedoraproject Fedora=21
Fedoraproject Fedora=22
Mageia Project Mageia=4
Cherokee-project Cherokee<=1.2.103
Cherokee-project Cherokee=1.2.2
Cherokee-project Cherokee=1.2.98
Cherokee-project Cherokee=1.2.99
Cherokee-project Cherokee=1.2.101
Cherokee-project Cherokee=1.2.102
Event History
Jul 2, 2014
CVE Published
via MITRE·01:00 AM
Data Sourced
via MITRE·01:00 AM
Description
Frequently Asked Questions
1
What is the severity of CVE-2014-4668?
CVE-2014-4668 has a medium severity rating as it allows remote attackers to bypass authentication.
2
How do I fix CVE-2014-4668?
To fix CVE-2014-4668, update Cherokee to version 1.2.104 or later.
3
Which versions of Cherokee are affected by CVE-2014-4668?
Cherokee versions up to and including 1.2.103 are affected by CVE-2014-4668.
4
What types of systems are vulnerable to CVE-2014-4668?
CVE-2014-4668 affects systems running Fedora versions 20, 21, 22, and Mageia version 4 with vulnerable Cherokee software.
5
Are there any known exploits for CVE-2014-4668?
Yes, CVE-2014-4668 can be exploited to gain unauthorized access to systems using vulnerable LDAP configurations.