Published: 20/03/2011 Updated: 17/08/2017

CVSS v2 Base Score: 5 | Impact Score: 2.9 | Exploitability Score: 10

VMScore: 505

Vector: AV:N/AC:L/Au:N/C:N/I:N/A:P

modrdn.c in slapd in OpenLDAP 2.4.x prior to 2.4.24 allows remote malicious users to cause a denial of service (daemon crash) via a relative Distinguished Name (DN) modification request (aka MODRDN operation) that contains an empty value for the OldDN field.

Vulnerable Product	Search on Vulmon	Subscribe to Product
openldap openldap 2.4.7
openldap openldap 2.4.6
openldap openldap 2.4.14
openldap openldap 2.4.15
openldap openldap 2.4.10
openldap openldap 2.4.22
openldap openldap 2.4.8
openldap openldap 2.4.16
openldap openldap 2.4.17
openldap openldap 2.4.23
openldap openldap 2.4.13
openldap openldap 2.4.12
openldap openldap 2.4.20
openldap openldap 2.4.21
openldap openldap 2.4.11
openldap openldap 2.4.9
openldap openldap 2.4.18
openldap openldap 2.4.19

Debian Bug report logs - #617606 CVE-2011-1024 CVE-2011-1025 Package: openldap; Maintainer for openldap is Debian OpenLDAP Maintainers <pkg-openldap-devel@listsaliothdebianorg>; Reported by: Moritz Muehlenhoff <jmm@debianorg> Date: Wed, 9 Mar 2011 21:45:05 UTC Severity: important Tags: security Found in version ...

An attacker could send crafted input to OpenLDAP and cause it to crash ...

source: wwwsecurityfocuscom/bid/46831/info OpenLDAP is prone to a remote denial-of-service vulnerability that affects the 'modify relative distinguished name' (modrdn) command Attackers can exploit this issue to deny service to legitimate users by crashing affected 'slapd' servers ldapmodrdn -x -H ldap://ldapserver -r '' o=test ...

CWE-399 http://secunia.com/advisories/43331 http://www.redhat.com/support/errata/RHSA-2011-0347.html http://openwall.com/lists/oss-security/2011/02/28/1 http://openwall.com/lists/oss-security/2011/03/01/11 https://bugzilla.redhat.com/show_bug.cgi?id=680975 http://openwall.com/lists/oss-security/2011/03/01/15 http://www.openldap.org/devel/cvsweb.cgi/servers/slapd/modrdn.c.diff?r1=1.170.2.8&r2=1.170.2.9 http://securitytracker.com/id?1025191 http://www.openldap.org/lists/openldap-announce/201102/msg00000.html http://openwall.com/lists/oss-security/2011/02/28/2 http://www.openldap.org/its/index.cgi/Software%20Bugs?id=6768 https://bugzilla.novell.com/show_bug.cgi?id=674985 http://www.vupen.com/english/advisories/2011/0665 http://www.mandriva.com/security/advisories?name=MDVSA-2011:055 http://www.mandriva.com/security/advisories?name=MDVSA-2011:056 http://www.ubuntu.com/usn/USN-1100-1 http://secunia.com/advisories/43718 http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10705 http://security.gentoo.org/glsa/glsa-201406-36.xml https://exchange.xforce.ibmcloud.com/vulnerabilities/66239 https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=617606 https://usn.ubuntu.com/1100-1/https://nvd.nist.gov https://www.exploit-db.com/exploits/35445/

CVE-2011-1081

Vulnerability Summary

Vendor Advisories

Exploits

References

Vulmon Search

About

Products

Connect