6.8

CVE-2011-1025

bind.cpp in back-ndb in OpenLDAP 2.4.x before 2.4.24 does not require authentication for the root Distinguished Name (DN), which allows remote attackers to bypass intended access restrictions via an arbitrary password.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Openldap ≫ Openldap Version2.4.6
Openldap ≫ Openldap Version2.4.7
Openldap ≫ Openldap Version2.4.8
Openldap ≫ Openldap Version2.4.9
Openldap ≫ Openldap Version2.4.10
Openldap ≫ Openldap Version2.4.11
Openldap ≫ Openldap Version2.4.12
Openldap ≫ Openldap Version2.4.13
Openldap ≫ Openldap Version2.4.14
Openldap ≫ Openldap Version2.4.15
Openldap ≫ Openldap Version2.4.16
Openldap ≫ Openldap Version2.4.17
Openldap ≫ Openldap Version2.4.18
Openldap ≫ Openldap Version2.4.19
Openldap ≫ Openldap Version2.4.20
Openldap ≫ Openldap Version2.4.21
Openldap ≫ Openldap Version2.4.22
Openldap ≫ Openldap Version2.4.23
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 4.45% 0.902
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
nvd@nist.gov 6.8 8.6 6.4
AV:N/AC:M/Au:N/C:P/I:P/A:P
CWE-287 Improper Authentication

When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct.

http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10705
http://security.gentoo.org/glsa/glsa-201406-36.xml
http://openwall.com/lists/oss-security/2011/02/24/12
http://openwall.com/lists/oss-security/2011/02/25/13
http://secunia.com/advisories/43331
Vendor Advisory
http://secunia.com/advisories/43718
http://www.mandriva.com/security/advisories?name=MDVSA-2011:056
http://www.openldap.org/lists/openldap-announce/201102/msg00000.html
http://www.redhat.com/support/errata/RHSA-2011-0347.html
http://www.ubuntu.com/usn/USN-1100-1
http://www.vupen.com/english/advisories/2011/0665
Vendor Advisory
http://securitytracker.com/id?1025190
http://www.openldap.org/devel/cvsweb.cgi/servers/slapd/back-ndb/bind.cpp.diff?r1=1.5&r2=1.8
Patch
http://www.openldap.org/its/index.cgi/Software%20Bugs?id=6661
https://bugzilla.redhat.com/show_bug.cgi?id=680472
Patch