CVE-2011-1024

Publication date 19 March 2011

Last updated 24 July 2024

Ubuntu priority

chain.c in back-ldap in OpenLDAP 2.4.x before 2.4.24, when a master-slave configuration with a chain overlay and ppolicy_forward_updates (aka authentication-failure forwarding) is used, allows remote authenticated users to bypass external-program authentication by sending an invalid password to a slave server.

Read the notes from the security team

Status

Show unmaintained releases

Package	Ubuntu Release	Status
openldap	10.10 maverick	Fixed 2.4.23-0ubuntu3.5
	10.04 LTS lucid	Fixed 2.4.21-0ubuntu5.4
	9.10 karmic	Fixed 2.4.18-0ubuntu1.2
	8.04 LTS hardy	Not in release
	6.06 LTS dapper	Not in release
openldap2.2	10.10 maverick	Not in release
	10.04 LTS lucid	Not in release
	9.10 karmic	Not in release
	8.04 LTS hardy	Not in release
	6.06 LTS dapper	Not affected
openldap2.3	10.10 maverick	Not in release
	10.04 LTS lucid	Not in release
	9.10 karmic	Not in release
	8.04 LTS hardy	Fixed 2.4.9-0ubuntu0.8.04.5
	6.06 LTS dapper	Not in release

Notes

jdstrand

openldap 2.2 does not use callbacks for checking if back-ldap returned any results

Patch details

For informational purposes only. We recommend not to cherry-pick updates. How can I get the fixes?

Package	Patch details
openldap	Vendor: https://rhn.redhat.com/errata/RHSA-2011-0347.html

References

Related Ubuntu Security Notices (USN)