Multiple vulnerabilities were found in OpenLDAP, allowing for Denial of Service or a man-in-the-middle attack.
| Package | Arch | Vulnerable | Unaffected |
|---|---|---|---|
| net-nds/openldap | * | < 2.4.35 | >= 2.4.35 |
OpenLDAP is an LDAP suite of application and development tools.
Multiple vulnerabilities have been discovered in OpenLDAP. Please review the CVE identifiers referenced below for details.
A remote attacker might employ a specially crafted certificate to conduct man-in-the-middle attacks on SSL connections made using OpenLDAP, bypass security restrictions or cause a Denial of Service condition.
There is no known workaround at this time.
All OpenLDAP users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose ">=net-nds/openldap-2.4.35"
A flaw in OpenLDAP allows remote unauthenticated attackers to cause a Denial of Service.
| Package | Arch | Vulnerable | Unaffected |
|---|---|---|---|
| net-nds/openldap | * | < 2.3.43 | >= 2.3.43 |
OpenLDAP Software is an open source implementation of the Lightweight Directory Access Protocol.
Cameron Hotchkies discovered an error within the parsing of ASN.1 BER encoded packets in the "ber_get_next()" function in libraries/liblber/io.c.
A remote unauthenticated attacker can send a specially crafted ASN.1 BER encoded packet which will trigger the error and cause an "assert()", terminating the "slapd" daemon.
There is no known workaround at this time.
All OpenLDAP users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose ">=net-nds/openldap-2.3.43"
Multiple Denial of Service vulnerabilities have been reported in OpenLDAP.
| Package | Arch | Vulnerable | Unaffected |
|---|---|---|---|
| net-nds/openldap | * | < 2.3.41 | >= 2.3.41 |
OpenLDAP Software is an open source implementation of the Lightweight Directory Access Protocol.
The following errors have been discovered in OpenLDAP:
A remote attacker can cause a Denial of Serivce by sending a malformed "objectClasses" attribute, and via unknown vectors that prevent the "new_attrs" array from being NULL terminated, and via a modrdn operation with a NOOP (LDAP_X_NO_OPERATION) control.
There is no known workaround at this time.
All OpenLDAP users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose ">=net-nds/openldap-2.3.41"
A shell script commonly released with OpenLDAP makes insecure usage of files in /tmp during the emerge process.
| Package | Arch | Vulnerable | Unaffected |
|---|---|---|---|
| net-nds/openldap | * | < 2.1.30-r10, < 2.2.28-r7, < 2.3.30-r2 | >= 2.1.30-r10, >= 2.2.28-r7, >= 2.3.30-r2 |
OpenLDAP Software is an open source implementation of the Lightweight Directory Access Protocol.
Tavis Ormandy of the Gentoo Linux Security Team has discovered that the file gencert.sh distributed with the Gentoo ebuild for OpenLDAP does not exit upon the existence of a directory in /tmp during installation allowing for directory traversal.
A local attacker could create a symbolic link in /tmp and potentially overwrite arbitrary system files upon a privileged user emerging OpenLDAP.
There is no known workaround at this time.
All OpenLDAP users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose "net-nds/openldap"
A flaw in OpenLDAP allows remote unauthenticated attackers to cause a Denial of Service.
| Package | Arch | Vulnerable | Unaffected |
|---|---|---|---|
| net-nds/openldap | * | < 2.3.27-r3 | >= 2.3.27-r3, >= 2.2.28-r5 (revision), >= 2.1.30-r8 (revision) |
OpenLDAP is a suite of LDAP-related applications and development tools.
Evgeny Legerov has discovered that the truncation of an incoming authcid longer than 255 characters and ending with a space as the 255th character will lead to an improperly computed name length. This will trigger an assert in the libldap code.
By sending a BIND request with a specially crafted authcid parameter to an OpenLDAP service, a remote attacker can cause the service to crash.
There is no known workaround at this time.
All OpenLDAP users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose "net-nds/openldap"
OpenLDAP and Gauche suffer from RUNPATH issues that may allow users in the "portage" group to escalate privileges.
| Package | Arch | Vulnerable | Unaffected |
|---|---|---|---|
| dev-scheme/gauche | * | < 0.8.6-r1 | >= 0.8.6-r1 |
| net-nds/openldap | * | < 2.2.28-r3 | >= 2.2.28-r3, >= 2.1.30-r6 (revision) |
OpenLDAP is a suite of LDAP-related application and development tools. Gauche is an R5RS Scheme interpreter.
Gentoo packaging for OpenLDAP and Gauche may introduce insecure paths into the list of directories that are searched for libraries at runtime.
A local attacker, who is a member of the "portage" group, could create a malicious shared object in the Portage temporary build directory that would be loaded at runtime by a dependent binary, potentially resulting in privilege escalation.
Only grant "portage" group rights to trusted users.
All OpenLDAP users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose net-nds/openldap
All Gauche users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose ">=dev-scheme/gauche-0.8.6-r1"
A failed password operation can cause the OpenLDAP slapd server, if it is using the back-ldbm backend, to free memory that was never allocated.
| Package | Arch | Vulnerable | Unaffected |
|---|---|---|---|
| net-nds/openldap | * | <= 2.1.12 | >= 2.1.13 |
OpenLDAP is a suite of LDAP-related application and development tools. It includes slapd (the standalone LDAP server), slurpd (the standalone LDAP replication server), and various LDAP libraries, utilities and example clients.
A password extended operation (password EXOP) which fails will cause the slapd server to free() an uninitialized pointer, possibly resulting in a segfault. This only affects servers using the back-ldbm backend.
Such a crash is not guaranteed with every failed operation, however, it is possible.
An attacker (or indeed, a normal user) may crash the OpenLDAP server, creating a Denial of Service condition.
A workaround is not currently known for this issue. All users are advised to upgrade to the latest version of the affected package.
OpenLDAP users should upgrade to version 2.1.13 or later:
# emerge sync # emerge -pv ">=net-nds/openldap-2.1.13" # emerge ">=net-nds/openldap-2.1.13"