PT-2011-1193 · Openldap · Openldap

Marcus Meissner + 1 · Published 2011-10-27 · Updated 2023-02-13 · CVE-2011-4079

Positive Technologies (AI Summary)

CVSS v2.0

6.8

Medium

Base vector

AV:N/AC:M/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions OpenLDAP versions 2.4.26 and earlier

Description The issue is related to an off-by-one error in the UTF8StringNormalize function, which can be exploited by remote attackers to cause a denial of service (slapd crash) via a zero-length string. This can trigger a heap-based buffer overflow. For example, an empty postalAddressAttribute value in an LDIF entry can be used to demonstrate this issue. Additionally, there are multiple vulnerabilities in the openldap package prior to version 2.4.35 that can lead to violations of confidentiality, integrity, and availability of protected information, and these can be exploited remotely.

Recommendations For OpenLDAP versions 2.4.26 and earlier, update to a version later than 2.4.26 to resolve the issue. For openldap package prior to version 2.4.35, update to version 2.4.35 or later to address the multiple vulnerabilities.

Fix

Improper Certificate Validation

Weakness Enumeration

CWE-295

CWE-189

Related Identifiers

BDU:2015-09683

CVE-2011-4079

Affected Products

Openldap

References · 15

• http://secunia.com/advisories/46599 · Vendor Advisory
• http://security.gentoo.org/glsa/glsa-201406-36.xml · Vendor Advisory
• https://bugzilla.redhat.com/show_bug.cgi?id=749324 · Patch
• https://osv.dev/vulnerability/DEBIAN-CVE-2011-4079 · Vendor Advisory
• http://ubuntu.com/usn/USN-1266-1 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2011-4079 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2011-4079 · Vendor Advisory
• https://bdu.fstec.ru/vul/2015-09683 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2011-4079 · Security Note
• http://openwall.com/lists/oss-security/2011/10/26/9 · Note
• http://openldap.org/its/index.cgi/Software%20Bugs?id=7059%3Bselectid=7059 · Note
• http://openldap.org/devel/gitweb.cgi?p=openldap.git%3Ba=commitdiff%3Bh=507238713b71208ec4f262f312cb495a302df9e9 · Note
• http://openwall.com/lists/oss-security/2011/10/26/5 · Note
• http://securityfocus.com/bid/50384 · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/70991 · Note