PT-2014-6050 · Cherokee · Cherokee

Matthew Daley · Published 2014-07-02 · Updated 2017-01-03 · CVE-2014-4668

Positive Technologies (AI Summary)

CVSS v2.0

6.8

Medium

Base vector

AV:N/AC:M/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Cherokee versions 1.2.103 and earlier

Description The issue concerns the cherokee validator ldap check function in validator ldap.c. When LDAP is used, it does not properly consider unauthenticated-bind semantics. This allows remote attackers to bypass authentication by using an empty password.

Recommendations For Cherokee versions 1.2.103 and earlier, consider disabling the LDAP authentication mechanism until a patch is available. Restrict access to the cherokee validator ldap check function to minimize the risk of exploitation. Avoid using empty passwords in the affected LDAP configuration until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Improper Authentication

Weakness Enumeration

CWE-287

Related Identifiers

CVE-2014-4668

MGASA-2015-0181

Affected Products

Cherokee

References · 15

• http://mandriva.com/security/advisories?name=MDVSA-2015:225 · Vendor Advisory
• http://lists.fedoraproject.org/pipermail/package-announce/2015-April/156190.html · Vendor Advisory
• http://lists.fedoraproject.org/pipermail/package-announce/2015-April/156162.html · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2014-4668 · Security Note
• https://osv.dev/vulnerability/MGASA-2015-0181 · Vendor Advisory
• https://lists.fedoraproject.org/pipermail/package-announce/2015-April/155776.html · Vendor Advisory
• https://advisories.mageia.org/MGASA-2015-0181.html · Security Note
• http://lists.fedoraproject.org/pipermail/package-announce/2015-April/155776.html · Vendor Advisory
• https://github.com/cherokee/webserver/commit/fbda667221c51f0aa476a02366e0cf66cb012f88 · Note
• http://openwall.com/lists/oss-security/2014/06/28/7 · Note
• http://openwall.com/lists/oss-security/2014/06/28/3 · Note
• http://advisories.mageia.org/MGASA-2015-0181.html · Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-4668 · Note
• http://securityfocus.com/bid/68249 · Note
• https://bugs.mageia.org/show_bug.cgi?id=15755 · Note