PT-2002-3167 · Openldap · Openldap2+7

Published 1970-01-01 · Updated 2008-09-10 · CVE-2002-1379

Positive Technologies (AI Summary)

CVSS v2.0

7.5

High

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions OpenLDAP versions 1.2.13 through 2.0.27 OpenLDAP2 versions prior to 2.2.0 libldap2 (affected versions not specified) ldap-gateways (affected versions not specified) openldap-clients versions 1.2.13 through 2.0.27 openldap-servers versions 1.2.13 through 2.0.27 openldap-devel versions 1.2.13 through 2.0.27 openldap12 version 1.2.13

Description The issue involves multiple vulnerabilities in OpenLDAP packages, which can lead to breaches of confidentiality, integrity, and availability of protected information. These vulnerabilities can be exploited remotely. The vulnerabilities affect various components of OpenLDAP, including openldap-clients, openldap-servers, openldap-devel, and libldap2. In the case of OpenLDAP2, the vulnerability allows remote or local attackers to execute arbitrary code when libldap reads the .ldaprc file within applications running with extra privileges.

Recommendations For OpenLDAP versions 1.2.13 through 2.0.27, update to a version later than 2.0.27. For OpenLDAP2 versions prior to 2.2.0, update to version 2.2.0 or later. For libldap2, at the moment, there is no information about a newer version that contains a fix for this vulnerability. For ldap-gateways, at the moment, there is no information about a newer version that contains a fix for this vulnerability. For openldap-clients versions 1.2.13 through 2.0.27, update to a version later than 2.0.27. For openldap-servers versions 1.2.13 through 2.0.27, update to a version later than 2.0.27. For openldap-devel versions 1.2.13 through 2.0.27, update to a version later than 2.0.27. For openldap12 version 1.2.13, update to a version later than 1.2.13.

Related Identifiers

BDU:2015-03158

BDU:2015-03159

BDU:2015-08174

BDU:2015-08175

BDU:2015-08176

BDU:2015-08177

BDU:2015-08178

BDU:2015-08179

BDU:2015-08180

BDU:2015-08181

BDU:2015-08182

CVE-2002-1379

DSA-227

Affected Products

Openldap

Openldap2

Ldap-Gateways

Libldap2

Openldap-Clients

Openldap-Devel

Openldap-Servers

Openldap12

References · 20

• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2002-1379 · Security Note
• https://bdu.fstec.ru/vul/2015-03159 · Security Note
• https://bdu.fstec.ru/vul/2015-08182 · Security Note
• https://bdu.fstec.ru/vul/2015-03158 · Security Note
• http://debian.org/security/2003/dsa-227 · Vendor Advisory
• https://bdu.fstec.ru/vul/2015-08176 · Security Note
• https://bdu.fstec.ru/vul/2015-08180 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2002-1508 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2002-1379 · Security Note
• http://mandriva.com/security/advisories?name=MDKSA-2003:006 · Vendor Advisory
• https://bdu.fstec.ru/vul/2015-08175 · Security Note
• https://bdu.fstec.ru/vul/2015-08174 · Security Note
• https://bdu.fstec.ru/vul/2015-08178 · Security Note
• https://bdu.fstec.ru/vul/2015-08181 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2002-1378 · Security Note