| Description: | Description:
The remote host is missing an update to openldap2.3
announced via advisory USN-1100-1.
Details follow:
It was discovered that OpenLDAP did not properly check forwarded
authentication failures when using a slave server and chain overlay. If
OpenLDAP were configured in this manner, an attacker could bypass
authentication checks by sending an invalid password to a slave server.
(CVE-2011-1024)
It was discovered that OpenLDAP did not properly perform authentication
checks to the rootdn when using the back-ndb backend. An attacker could
exploit this to access the directory by sending an arbitrary password.
Ubuntu does not ship OpenLDAP with back-ndb support by default. This issue
did not affect Ubuntu 8.04 LTS. (CVE-2011-1025)
It was discovered that OpenLDAP did not properly validate modrdn requests.
An unauthenticated remote user could use this to cause a denial of service
via application crash. (CVE-2011-1081)
Solution:
The problem can be corrected by upgrading your system to the
following package versions:
Ubuntu 8.04 LTS:
slapd 2.4.9-0ubuntu0.8.04.5
Ubuntu 9.10:
slapd 2.4.18-0ubuntu1.2
Ubuntu 10.04 LTS:
slapd 2.4.21-0ubuntu5.4
Ubuntu 10.10:
slapd 2.4.23-0ubuntu3.5
In general, a standard system update will make all the necessary changes.
http://www.securityspace.com/smysecure/catid.html?in=USN-1100-1
Risk factor : High
CVSS Score:
6.8
|
