CVE-2010-0212
published 2010-07-28CVE-2010-0212: OpenLDAP 2.4.22 allows remote attackers to cause a denial of service (crash) via a modrdn call with a zero-length RDN destination string, which is not properly…
PriorityP426medium5CVSS 2.0
AVNACLAuNCNINAP
EPSS
6.22%
92.7th percentile
OpenLDAP 2.4.22 allows remote attackers to cause a denial of service (crash) via a modrdn call with a zero-length RDN destination string, which is not properly handled by the smr_normalize function and triggers a NULL pointer dereference in the IA5StringNormalize function in schema_init.c, as demonstrated using the Codenomicon LDAPv3 test suite.
Affected
8 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | openldap | < openldap 2.4.23-1 (bookworm) | openldap 2.4.23-1 (bookworm) |
| openldap | openldap | — | — |
| openldap | openldap | >= 0 < 2.4.23-1 | 2.4.23-1 |
| openldap | openldap | >= 0 < 2.4.23-1 | 2.4.23-1 |
| openldap | openldap | >= 0 < 2.4.23-1 | 2.4.23-1 |
| openldap | openldap | >= 0 < 2.4.23-1 | 2.4.23-1 |
| vmware | esxi | — | — |
| vmware | vmware_workstation | — | — |
Detection & IOCsextracted from sources · hover to see the quote
- →Monitor slapd for crashes triggered by modrdn requests containing a zero-length RDN destination string; a NULL pointer dereference in IA5StringNormalize (schema_init.c:2696) is the crash signature. ↗
- →The vulnerability is pre-authentication on OpenLDAP 2.4.x; any unauthenticated remote LDAPv3 modrdn request with an empty RDN string should be treated as suspicious. ↗
- →On OpenLDAP 2.3.x (RHEL-5), the attack requires an authenticated user with sufficient privileges to perform modrdn; selfwrite privilege alone is not sufficient. ↗
- →Ubuntu deployments running slapd under the OpenLDAP AppArmor profile provide an additional containment layer; verify AppArmor confinement is active for slapd. ↗
- ·OpenLDAP versions 2.4.x prior to 2.4.23 are vulnerable pre-authentication; versions 2.3.x require authenticated modrdn privileges; versions 2.2.x and older (RHEL-4/RHEL-3) are not affected because IA5StringValidate rejects empty strings before IA5StringNormalize is reached. ↗
- ·The fix was introduced in OpenLDAP 2.4.23; the upstream patch adds an additional restriction disallowing empty values in DNs regardless of attribute syntax, rather than changing IA5StringValidate. ↗
CVSS provenance
nvdv2.05.0MEDIUMAV:N/AC:L/Au:N/C:N/I:N/A:P
osv5.0MEDIUM
vendor_ubuntu9.8CRITICAL
vendor_debian5.0MEDIUM
vendor_redhat5.0MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
VMware
VMware ESX third party updates for Service Console packages glibc, sudo, and openldap
vendor_vmware·2011-01-04·CVSS 6.9
CVE-2010-0211 [MEDIUM] VMware ESX third party updates for Service Console packages glibc, sudo, and openldap
VMSA-2011-0001: VMware ESX third party updates for Service Console packages glibc, sudo, and openldap
a. Service Console update for glibc The service console packages glibc, glibc-common, and nscd are each updated to version 2.5-34.4908.vmw. The Common Vulnerabilities and Exposures project ( cve.mitre.org) has assigned the names CVE-2010-3847 and CVE-2010-3856 to the issues addressed in this update. Column 4 of the following table lists the action required to remediate the vulnerability in each release, if a solution is available. VMware Product ============= Product Version ======= Running on ======= Replace with/ Apply Patch ================= VMware Product ============= VirtualCente Product Version ======= any Running on ======= Windows Replace with/ Apply Patch ================= not a
Ubuntu
OpenLDAP vulnerabilities
vendor_ubuntu·2010-08-09·CVSS 9.8
CVE-2010-0211 [CRITICAL] OpenLDAP vulnerabilities
Title: OpenLDAP vulnerabilities
Using the Codenomicon LDAPv3 test suite, Ilkka Mattila and Tuomas
Salomäki discovered that the slap_modrdn2mods function in modrdn.c
in OpenLDAP does not check the return value from a call to the
smr_normalize function. A remote attacker could use specially crafted
modrdn requests to crash the slapd daemon or possibly execute arbitrary
code. (CVE-2010-0211)
Using the Codenomicon LDAPv3 test suite, Ilkka Mattila and Tuomas
Salomäki discovered that OpenLDAP does not properly handle empty
RDN strings. A remote attacker could use specially crafted modrdn
requests to crash the slapd daemon. (CVE-2010-0212)
In the default installation under Ubuntu 8.04 LTS and later, attackers
would be isolated by the OpenLDAP AppArmor profile for the slapd daemon.
Instruction
Red Hat
openldap: modrdn processing IA5StringNormalize NULL pointer dereference
vendor_redhat·2010-07-19·CVSS 5.0
CVE-2010-0212 [MEDIUM] CWE-476 openldap: modrdn processing IA5StringNormalize NULL pointer dereference
openldap: modrdn processing IA5StringNormalize NULL pointer dereference
OpenLDAP 2.4.22 allows remote attackers to cause a denial of service (crash) via a modrdn call with a zero-length RDN destination string, which is not properly handled by the smr_normalize function and triggers a NULL pointer dereference in the IA5StringNormalize function in schema_init.c, as demonstrated using the Codenomicon LDAPv3 test suite.
Package: openldap (Red Hat Enterprise Linux 4) - Affected
Package: openldap (Red Hat Enterprise Linux 6) - Not affected
Debian
CVE-2010-0212: openldap - OpenLDAP 2.4.22 allows remote attackers to cause a denial of service (crash) via...
vendor_debian·2010·CVSS 5.0
CVE-2010-0212 [MEDIUM] CVE-2010-0212: openldap - OpenLDAP 2.4.22 allows remote attackers to cause a denial of service (crash) via...
OpenLDAP 2.4.22 allows remote attackers to cause a denial of service (crash) via a modrdn call with a zero-length RDN destination string, which is not properly handled by the smr_normalize function and triggers a NULL pointer dereference in the IA5StringNormalize function in schema_init.c, as demonstrated using the Codenomicon LDAPv3 test suite.
Scope: local
bookworm: resolved (fixed in 2.4.23-1)
bullseye: resolved (fixed in 2.4.23-1)
forky: resolved (fixed in 2.4.23-1)
sid: resolved (fixed in 2.4.23-1)
trixie: resolved (fixed in 2.4.23-1)
GHSA
GHSA-w879-m4wh-92f9: OpenLDAP 2
ghsa_unreviewed·2022-05-02
CVE-2010-0212 [MEDIUM] GHSA-w879-m4wh-92f9: OpenLDAP 2
OpenLDAP 2.4.22 allows remote attackers to cause a denial of service (crash) via a modrdn call with a zero-length RDN destination string, which is not properly handled by the smr_normalize function and triggers a NULL pointer dereference in the IA5StringNormalize function in schema_init.c, as demonstrated using the Codenomicon LDAPv3 test suite.
OSV
CVE-2010-0212: OpenLDAP 2
osv·2010-07-28·CVSS 5.0
CVE-2010-0212 [MEDIUM] CVE-2010-0212: OpenLDAP 2
OpenLDAP 2.4.22 allows remote attackers to cause a denial of service (crash) via a modrdn call with a zero-length RDN destination string, which is not properly handled by the smr_normalize function and triggers a NULL pointer dereference in the IA5StringNormalize function in schema_init.c, as demonstrated using the Codenomicon LDAPv3 test suite.
No detection rules found.
No public exploits indexed.
http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10705http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10735http://lists.apple.com/archives/security-announce/2010//Nov/msg00000.htmlhttp://lists.opensuse.org/opensuse-security-announce/2010-08/msg00001.htmlhttp://secunia.com/advisories/40639http://secunia.com/advisories/40687http://secunia.com/advisories/42787http://security.gentoo.org/glsa/glsa-201406-36.xmlhttp://support.apple.com/kb/HT4435http://www.openldap.org/its/index.cgi/Software%20Bugs?id=6570http://www.redhat.com/support/errata/RHSA-2010-0542.htmlhttp://www.securityfocus.com/archive/1/515545/100/0/threadedhttp://www.securityfocus.com/bid/41770http://www.securitytracker.com/id?1024221http://www.vmware.com/security/advisories/VMSA-2011-0001.htmlhttp://www.vupen.com/english/advisories/2010/1849http://www.vupen.com/english/advisories/2010/1858http://www.vupen.com/english/advisories/2011/0025http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10705http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10735http://lists.apple.com/archives/security-announce/2010//Nov/msg00000.htmlhttp://lists.opensuse.org/opensuse-security-announce/2010-08/msg00001.htmlhttp://secunia.com/advisories/40639http://secunia.com/advisories/40687http://secunia.com/advisories/42787http://security.gentoo.org/glsa/glsa-201406-36.xmlhttp://support.apple.com/kb/HT4435http://www.openldap.org/its/index.cgi/Software%20Bugs?id=6570http://www.redhat.com/support/errata/RHSA-2010-0542.htmlhttp://www.securityfocus.com/archive/1/515545/100/0/threadedhttp://www.securityfocus.com/bid/41770http://www.securitytracker.com/id?1024221http://www.vmware.com/security/advisories/VMSA-2011-0001.htmlhttp://www.vupen.com/english/advisories/2010/1849http://www.vupen.com/english/advisories/2010/1858http://www.vupen.com/english/advisories/2011/0025
2010-07-28
Published