CVE-2010-0211
published 2010-07-28CVE-2010-0211: The slap_modrdn2mods function in modrdn.c in OpenLDAP 2.4.22 does not check the return value of a call to the smr_normalize function, which allows remote…
PriorityP262critical9.8CVSS 3.1
AVNACLPRNUINSUCHIHAH
EXPLOIT
EPSS
29.24%
98.0th percentile
The slap_modrdn2mods function in modrdn.c in OpenLDAP 2.4.22 does not check the return value of a call to the smr_normalize function, which allows remote attackers to cause a denial of service (segmentation fault) and possibly execute arbitrary code via a modrdn call with an RDN string containing invalid UTF-8 sequences, which triggers a free of an invalid, uninitialized pointer in the slap_mods_free function, as demonstrated using the Codenomicon LDAPv3 test suite.
Affected
13 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| apple | mac_os_x | >= 10.6.0 < 10.6.5 | 10.6.5 |
| apple | mac_os_x_server | >= 10.6.0 < 10.6.5 | 10.6.5 |
| debian | openldap | < openldap 2.4.23-1 (bookworm) | openldap 2.4.23-1 (bookworm) |
| openldap | openldap | — | — |
| openldap | openldap | >= 0 < 2.4.23-1 | 2.4.23-1 |
| openldap | openldap | >= 0 < 2.4.23-1 | 2.4.23-1 |
| openldap | openldap | >= 0 < 2.4.23-1 | 2.4.23-1 |
| openldap | openldap | >= 0 < 2.4.23-1 | 2.4.23-1 |
| opensuse | opensuse | — | — |
| vmware | esxi | — | — |
| vmware | esxi | — | — |
| vmware | esxi | — | — |
| vmware | vmware_workstation | — | — |
Detection & IOCsextracted from sources · hover to see the quote
- →Detect modrdn requests containing invalid UTF-8 sequences in the RDN string (e.g., byte sequence #80 or higher non-valid UTF-8 bytes) sent to LDAP service; these trigger the vulnerable slap_modrdn2mods code path. ↗
- →Detect modrdn requests with an empty RDN string (e.g., 'dc=') targeting slapd; this triggers the related CVE-2010-0212 NULL pointer dereference in IA5StringNormalize. ↗
- →Monitor slapd process for segmentation faults or unexpected crashes following receipt of LDAPv3 ModifyDN (modrdn) operations, which may indicate exploitation attempts. ↗
- →On Ubuntu systems, check AppArmor logs for slapd profile violations that may indicate exploitation attempts against CVE-2010-0211. ↗
- ·The vulnerability is pre-auth exploitable in OpenLDAP 2.4.x (Fedora/RHEL-6); in OpenLDAP 2.3.x (RHEL-5) it can only be triggered by an authenticated user with sufficient privileges to perform modrdn operations — selfwrite privilege is not sufficient. ↗
- ·OpenLDAP versions as shipped with RHEL-4 and RHEL-3 are not affected because IA5StringValidate() rejects empty strings before the vulnerable IA5StringNormalize() is called. ↗
- ·The vulnerability is fixed in OpenLDAP 2.4.23; Debian packages resolved at version 2.4.23-1. ↗
CVSS provenance
nvdv3.19.8CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
nvdv2.05.0MEDIUMAV:N/AC:L/Au:N/C:N/I:N/A:P
osv9.8CRITICAL
vendor_debian9.8CRITICAL
vendor_redhat9.8CRITICAL
vendor_ubuntu9.8CRITICAL
CVEs like this are exactly what “Exploited This Week” covers.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
VMware
VMware ESX third party updates for Service Console packages glibc, sudo, and openldap
vendor_vmware·2011-01-04·CVSS 6.9
CVE-2010-0211 [MEDIUM] VMware ESX third party updates for Service Console packages glibc, sudo, and openldap
VMSA-2011-0001: VMware ESX third party updates for Service Console packages glibc, sudo, and openldap
a. Service Console update for glibc The service console packages glibc, glibc-common, and nscd are each updated to version 2.5-34.4908.vmw. The Common Vulnerabilities and Exposures project ( cve.mitre.org) has assigned the names CVE-2010-3847 and CVE-2010-3856 to the issues addressed in this update. Column 4 of the following table lists the action required to remediate the vulnerability in each release, if a solution is available. VMware Product ============= Product Version ======= Running on ======= Replace with/ Apply Patch ================= VMware Product ============= VirtualCente Product Version ======= any Running on ======= Windows Replace with/ Apply Patch ================= not a
Ubuntu
OpenLDAP vulnerabilities
vendor_ubuntu·2010-08-09·CVSS 9.8
CVE-2010-0211 [CRITICAL] OpenLDAP vulnerabilities
Title: OpenLDAP vulnerabilities
Using the Codenomicon LDAPv3 test suite, Ilkka Mattila and Tuomas
Salomäki discovered that the slap_modrdn2mods function in modrdn.c
in OpenLDAP does not check the return value from a call to the
smr_normalize function. A remote attacker could use specially crafted
modrdn requests to crash the slapd daemon or possibly execute arbitrary
code. (CVE-2010-0211)
Using the Codenomicon LDAPv3 test suite, Ilkka Mattila and Tuomas
Salomäki discovered that OpenLDAP does not properly handle empty
RDN strings. A remote attacker could use specially crafted modrdn
requests to crash the slapd daemon. (CVE-2010-0212)
In the default installation under Ubuntu 8.04 LTS and later, attackers
would be isolated by the OpenLDAP AppArmor profile for the slapd daemon.
Instruction
Red Hat
openldap: modrdn processing uninitialized pointer free
vendor_redhat·2010-07-19·CVSS 9.8
CVE-2010-0211 [CRITICAL] openldap: modrdn processing uninitialized pointer free
openldap: modrdn processing uninitialized pointer free
The slap_modrdn2mods function in modrdn.c in OpenLDAP 2.4.22 does not check the return value of a call to the smr_normalize function, which allows remote attackers to cause a denial of service (segmentation fault) and possibly execute arbitrary code via a modrdn call with an RDN string containing invalid UTF-8 sequences, which triggers a free of an invalid, uninitialized pointer in the slap_mods_free function, as demonstrated using the Codenomicon LDAPv3 test suite.
Package: openldap (Red Hat Enterprise Linux 6) - Not affected
Debian
CVE-2010-0211: openldap - The slap_modrdn2mods function in modrdn.c in OpenLDAP 2.4.22 does not check the ...
vendor_debian·2010·CVSS 9.8
CVE-2010-0211 [CRITICAL] CVE-2010-0211: openldap - The slap_modrdn2mods function in modrdn.c in OpenLDAP 2.4.22 does not check the ...
The slap_modrdn2mods function in modrdn.c in OpenLDAP 2.4.22 does not check the return value of a call to the smr_normalize function, which allows remote attackers to cause a denial of service (segmentation fault) and possibly execute arbitrary code via a modrdn call with an RDN string containing invalid UTF-8 sequences, which triggers a free of an invalid, uninitialized pointer in the slap_mods_free function, as demonstrated using the Codenomicon LDAPv3 test suite.
Scope: local
bookworm: resolved (fixed in 2.4.23-1)
bullseye: resolved (fixed in 2.4.23-1)
forky: resolved (fixed in 2.4.23-1)
sid: resolved (fixed in 2.4.23-1)
trixie: resolved (fixed in 2.4.23-1)
GHSA
GHSA-m9h3-f3g9-fqrf: The slap_modrdn2mods function in modrdn
ghsa_unreviewed·2022-05-02
CVE-2010-0211 [MEDIUM] CWE-252 GHSA-m9h3-f3g9-fqrf: The slap_modrdn2mods function in modrdn
The slap_modrdn2mods function in modrdn.c in OpenLDAP 2.4.22 does not check the return value of a call to the smr_normalize function, which allows remote attackers to cause a denial of service (segmentation fault) and possibly execute arbitrary code via a modrdn call with an RDN string containing invalid UTF-8 sequences, which triggers a free of an invalid, uninitialized pointer in the slap_mods_free function, as demonstrated using the Codenomicon LDAPv3 test suite.
OSV
CVE-2010-0211: The slap_modrdn2mods function in modrdn
osv·2010-07-28·CVSS 9.8
CVE-2010-0211 [CRITICAL] CVE-2010-0211: The slap_modrdn2mods function in modrdn
The slap_modrdn2mods function in modrdn.c in OpenLDAP 2.4.22 does not check the return value of a call to the smr_normalize function, which allows remote attackers to cause a denial of service (segmentation fault) and possibly execute arbitrary code via a modrdn call with an RDN string containing invalid UTF-8 sequences, which triggers a free of an invalid, uninitialized pointer in the slap_mods_free function, as demonstrated using the Codenomicon LDAPv3 test suite.
No detection rules found.
Bugzilla
CVE-2010-0212 openldap: modrdn processing IA5StringNormalize NULL pointer dereference
bugzilla·2010-06-18·CVSS 9.8
CVE-2010-0212 [CRITICAL] CVE-2010-0212 openldap: modrdn processing IA5StringNormalize NULL pointer dereference
CVE-2010-0212 openldap: modrdn processing IA5StringNormalize NULL pointer dereference
A vulnerability was found in OpenLDAP during the processing of a modrdn call with a specially crafted destination rdn string. An unauthenticated user could
cause slapd to crash due to a NULL pointer dereference.
Quoting the report:
As with bug CVE-2010-0211 (bug #605448), the crash occurs during a call to smr_normalize, but in this case the call points to IA5StringNormalize which crashes with a null pointer dereference at schema_init.c:2696.
This has been reportedly tested against upstream 2.4.22 as well as 2.4.11 (Debian) and 2.4.21 (Ubuntu).
Acknowledgements:
Red Hat would like to thank CERT-FI for responsibly reporting this flaw, who credit Ilkka Mattila and Tuomas Salomäki for the discovery of t
Bugzilla
CVE-2010-0211 openldap: modrdn processing uninitialized pointer free
bugzilla·2010-06-18·CVSS 9.8
CVE-2010-0211 [CRITICAL] CVE-2010-0211 openldap: modrdn processing uninitialized pointer free
CVE-2010-0211 openldap: modrdn processing uninitialized pointer free
A vulnerability was found in OpenLDAP during the processing of a modrdn call with a specially crafted destination rdn string. An unauthenticated user could cause slapd to segfault or abort.
Quoting the report:
In the function modrdn.c:386:slap_modrdn2mods() a call is made to
448:*desc->ad_type->sat_equality->smr_normalize() without checking its
return value. In this case the call fails and leaves mod_tmp->sml_nvalues
uninitialized which leads to an invalid free() later in
modrdn.c:202:slap_mods_free(). The breakdown of smr_normalize() is caused
by invalid UTF-8 sequences, which are passed to the software via
hex-formatted strings. It could be possible to insert and execute malicious
code by careful manipulation of the
CWE
Access of Uninitialized Pointer
mitre_cwe
CWE-824 Access of Uninitialized Pointer
CWE-824: Access of Uninitialized Pointer
The product accesses or uses a pointer that has not been initialized.
If the pointer contains an uninitialized value, then the value might not point to a valid memory location. This could cause the product to read from or write to unexpected memory locations, leading to a denial of service. If the uninitialized pointer is used as a function call, then arbitrary functions could be invoked. If an attacker can influence the portion of uninitialized memory that is contained in the pointer, this weakness could be leveraged to execute code or perform other attacks. Depending on memory layout, associated memory management behaviors, and product operation, the attacker might be able to influence the contents of the uninitialized pointer, thus gaining more
CWE
Unchecked Return Value
mitre_cwe
CWE-252 Unchecked Return Value
CWE-252: Unchecked Return Value
The product does not check the return value from a method or function, which can prevent it from detecting unexpected states and conditions.
Two common programmer assumptions are "this function call can never fail" and "it doesn't matter if this function call fails". If an attacker can force the function to fail or otherwise return a value that is not expected, then the subsequent program logic could lead to a vulnerability, because the product is not in a state that the programmer assumes. For example, if the program calls a function to drop privileges but does not check the return code to ensure that privileges were successfully dropped, then the program will continue to operate with the higher privileges.
Background: Many functions will return some val
http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10705http://lists.apple.com/archives/security-announce/2010//Nov/msg00000.htmlhttp://lists.opensuse.org/opensuse-security-announce/2010-08/msg00001.htmlhttp://secunia.com/advisories/40639http://secunia.com/advisories/40677http://secunia.com/advisories/40687http://secunia.com/advisories/42787http://security.gentoo.org/glsa/glsa-201406-36.xmlhttp://support.apple.com/kb/HT4435http://www.openldap.org/its/index.cgi/Software%20Bugs?id=6570http://www.redhat.com/support/errata/RHSA-2010-0542.htmlhttp://www.redhat.com/support/errata/RHSA-2010-0543.htmlhttp://www.securityfocus.com/archive/1/515545/100/0/threadedhttp://www.securityfocus.com/bid/41770http://www.securitytracker.com/id?1024221http://www.vmware.com/security/advisories/VMSA-2011-0001.htmlhttp://www.vupen.com/english/advisories/2010/1849http://www.vupen.com/english/advisories/2010/1858http://www.vupen.com/english/advisories/2011/0025http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10705http://lists.apple.com/archives/security-announce/2010//Nov/msg00000.htmlhttp://lists.opensuse.org/opensuse-security-announce/2010-08/msg00001.htmlhttp://secunia.com/advisories/40639http://secunia.com/advisories/40677http://secunia.com/advisories/40687http://secunia.com/advisories/42787http://security.gentoo.org/glsa/glsa-201406-36.xmlhttp://support.apple.com/kb/HT4435http://www.openldap.org/its/index.cgi/Software%20Bugs?id=6570http://www.redhat.com/support/errata/RHSA-2010-0542.htmlhttp://www.redhat.com/support/errata/RHSA-2010-0543.htmlhttp://www.securityfocus.com/archive/1/515545/100/0/threadedhttp://www.securityfocus.com/bid/41770http://www.securitytracker.com/id?1024221http://www.vmware.com/security/advisories/VMSA-2011-0001.htmlhttp://www.vupen.com/english/advisories/2010/1849http://www.vupen.com/english/advisories/2010/1858http://www.vupen.com/english/advisories/2011/0025
2010-07-28
Published