PT-2006-1042 · Openldap+1 · Openldap+1
Howard Chu
·
Published
2006-09-07
·
Updated
2018-10-17
·
CVE-2006-4600
CVSS v2.0
7.5
High
| Vector | AV:N/AC:L/Au:N/C:P/I:P/A:P |
Name of the Vulnerable Software and Affected Versions:
OpenLDAP versions prior to 2.3.25
OpenLDAP version 2.0.27
Description:
The issue allows remote authenticated users with self-write Access Control List (ACL) privileges to modify arbitrary Distinguished Names (DN). This can lead to a breach of confidentiality, integrity, and availability of protected information. The exploitation of this issue can be carried out remotely.
Recommendations:
For OpenLDAP versions prior to 2.3.25, update to version 2.3.25 or later.
For OpenLDAP version 2.0.27, consider upgrading to a newer version or applying configuration changes to restrict access to sensitive areas until a patch is available.
As a temporary workaround, consider restricting access to the
selfwrite Access Control List (ACL) privileges to minimize the risk of exploitation.Fix
Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
Openldap
Red Hat