Public exploit available
Public proof-of-concept or exploit code exists (ExploitDB / Metasploit / Nuclei).

CVE-2010-0211 — Unchecked Return Value in Openldap

CWE-252 — Unchecked Return Value10 documents9 sources
Severity
9.8CRITICALNVD
EPSS
42.6%
top 2.52%
CISA KEV
Not in KEV
Exploit
PoC available
Public exploit / PoC exists
Affected products
5
OpenldapApple MAC OS XApple MAC OS X Server+2 more
Timeline
PublishedJul 28
Latest updateMay 2

Description

The slap_modrdn2mods function in modrdn.c in OpenLDAP 2.4.22 does not check the return value of a call to the smr_normalize function, which allows remote attackers to cause a denial of service (segmentation fault) and possibly execute arbitrary code via a modrdn call with an RDN string containing invalid UTF-8 sequences, which triggers a free of an invalid, uninitialized pointer in the slap_mods_free function, as demonstrated using the Codenomicon LDAPv3 test suite.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HExploitability: 3.9 | Impact: 5.9

Affected Packages6 packages

▶Debianopenldap/openldap< 2.4.23-1+3
▶NVDopenldap/openldap2.4.22
▶NVDapple/mac_os_x10.6.0 — 10.6.5
▶NVDapple/mac_os_x_server10.6.0 — 10.6.5
▶NVDvmware/esxi4.0, 4.1+1

Patches

Patch: www.securityfocus.com ↗Patch: www.securityfocus.com ↗

🔴Vulnerability Details

3
GHSA
GHSA-m9h3-f3g9-fqrf: The slap_modrdn2mods function in modrdn↗2022-05-02
▶
OSV
CVE-2010-0211: The slap_modrdn2mods function in modrdn↗2010-07-28
▶
CVEList
CVE-2010-0211: The slap_modrdn2mods function in modrdn↗2010-07-27
▶

💥Exploits & PoCs

1
Exploit-DB
OpenLDAP 2.4.22 - 'modrdn' Multiple Vulnerabilities↗2010-07-19
▶

📋Vendor Advisories

3
Ubuntu
OpenLDAP vulnerabilities↗2010-08-09
▶
Red Hat
openldap: modrdn processing uninitialized pointer free↗2010-07-19
▶
Debian
CVE-2010-0211: openldap - The slap_modrdn2mods function in modrdn.c in OpenLDAP 2.4.22 does not check the ...↗2010
▶

💬Community

2
Bugzilla
CVE-2010-0212 openldap: modrdn processing IA5StringNormalize NULL pointer dereference↗2010-06-18
▶
Bugzilla
CVE-2010-0211 openldap: modrdn processing uninitialized pointer free↗2010-06-18
▶
CVE-2010-0211 — Unchecked Return Value in Openldap | cvebase