CVE-2019-13057

Published: Jul 26, 2019Modified: Nov 21, 2024

4.9

Vector

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N

Exploitability: 1.2 / Impact: 3.6

Source: NVD

Description

An issue was discovered in the server in OpenLDAP before 2.4.48. When the server administrator delegates rootDN (database admin) privileges for certain databases but wants to maintain isolation (e.g., for multi-tenant deployments), slapd does not properly stop a rootDN from requesting authorization as an identity from another database during a SASL bind or with a proxyAuthz (RFC 4370) control. (It is not a common configuration to deploy a system where the server administrator and a DB administrator enjoy different levels of trust.)

Affected (29)

Products: Openldap: Openldap · Canonical: Ubuntu Linux · Debian: Debian Linux · +4 more

Show all products

Openldap: Openldap · Canonical: Ubuntu Linux · Debian: Debian Linux · Opensuse: Leap · Apple: Mac Os X · Mcafee: Policy Auditor · Oracle: Blockchain Platform, Solaris, Zfs Storage Appliance Kit

1 product

1 product

1 product

1 product

1 product

1 product

3 products

Blockchain Platform

Zfs Storage Appliance Kit

Configuration A

1 vulnerable

Vulnerable Software	Affected Versions
Openldap Openldap	Before 2.4.48

Configuration B

5 vulnerable

Vulnerable Software	Affected Versions
Canonical Ubuntu Linux	Version 12.04
Canonical Ubuntu Linux	Version 14.04
Canonical Ubuntu Linux	Version 16.04
Canonical Ubuntu Linux	Version 18.04
Canonical Ubuntu Linux	Version 19.04

Configuration C

1 vulnerable

Vulnerable Software	Affected Versions
Debian Debian Linux	Version 8.0

Configuration D

2 vulnerable

Vulnerable Software	Affected Versions
Opensuse Leap	Version 15.0
Opensuse Leap	Version 15.1

Configuration E

15 vulnerable

Vulnerable Software	Affected Versions
Apple Mac Os X	From 10.13 to 10.13.6
Apple Mac Os X	From 10.14 to 10.14.6
Apple Mac Os X	From 10.15 to 10.15.2
Apple Mac Os X	Version 10.13.6
Apple Mac Os X	Version 10.13.6 security_update_2018-002
Apple Mac Os X	Version 10.13.6 security_update_2018-003
Apple Mac Os X	Version 10.13.6 security_update_2019-001
Apple Mac Os X	Version 10.13.6 security_update_2019-002
Apple Mac Os X	Version 10.13.6 security_update_2019-003
Apple Mac Os X	Version 10.13.6 security_update_2019-004
Apple Mac Os X	Version 10.13.6 security_update_2019-005
Apple Mac Os X	Version 10.13.6 security_update_2019-006
Apple Mac Os X	Version 10.14.6
Apple Mac Os X	Version 10.14.6
Apple Mac Os X	Version 10.14.6 security_update_2019-001

Configuration F

2 vulnerable

Vulnerable Software	Affected Versions
Mcafee Policy Auditor	Before 6.5.1
Mcafee Policy Auditor	Version 6.5.1

Configuration G

3 vulnerable

Vulnerable Software	Affected Versions
Oracle Blockchain Platform	Before 21.1.2
Oracle Solaris	Version 11
Oracle Zfs Storage Appliance Kit	Version 8.8

References (28)

http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00053.html

Source: cve@mitre.org

Mailing ListThird Party Advisory

http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00058.html

Source: cve@mitre.org

Mailing ListThird Party Advisory

http://seclists.org/fulldisclosure/2019/Dec/26

Source: cve@mitre.org

Mailing ListThird Party Advisory

https://kc.mcafee.com/corporate/index?page=content&id=SB10365

Source: cve@mitre.org

Third Party Advisory

https://lists.debian.org/debian-lts-announce/2019/08/msg00024.html

Source: cve@mitre.org

Mailing ListThird Party Advisory

https://seclists.org/bugtraq/2019/Dec/23

Source: cve@mitre.org

Mailing ListThird Party Advisory

https://security.netapp.com/advisory/ntap-20190822-0004/

Source: cve@mitre.org

Third Party Advisory

https://support.apple.com/kb/HT210788

Source: cve@mitre.org

Third Party Advisory

https://usn.ubuntu.com/4078-1/

Source: cve@mitre.org

Third Party Advisory

https://usn.ubuntu.com/4078-2/

Source: cve@mitre.org

Third Party Advisory

https://www.openldap.org/its/?findid=9038

Source: cve@mitre.org

Mailing ListVendor Advisory

https://www.openldap.org/lists/openldap-announce/201907/msg00001.html

Source: cve@mitre.org

Mailing ListProductVendor Advisory

https://www.oracle.com/security-alerts/cpuapr2020.html

Source: cve@mitre.org

PatchThird Party Advisory

https://www.oracle.com/security-alerts/cpuapr2022.html

Source: cve@mitre.org

PatchThird Party Advisory

http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00053.html

Source: af854a3a-2127-422b-91ae-364da2661108

Mailing ListThird Party Advisory

http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00058.html

Source: af854a3a-2127-422b-91ae-364da2661108

Mailing ListThird Party Advisory

http://seclists.org/fulldisclosure/2019/Dec/26

Source: af854a3a-2127-422b-91ae-364da2661108

Mailing ListThird Party Advisory

https://kc.mcafee.com/corporate/index?page=content&id=SB10365

Source: af854a3a-2127-422b-91ae-364da2661108

Third Party Advisory

https://lists.debian.org/debian-lts-announce/2019/08/msg00024.html

Source: af854a3a-2127-422b-91ae-364da2661108

Mailing ListThird Party Advisory

https://seclists.org/bugtraq/2019/Dec/23

Source: af854a3a-2127-422b-91ae-364da2661108

Mailing ListThird Party Advisory

https://security.netapp.com/advisory/ntap-20190822-0004/

Source: af854a3a-2127-422b-91ae-364da2661108

Third Party Advisory

https://support.apple.com/kb/HT210788

Source: af854a3a-2127-422b-91ae-364da2661108

Third Party Advisory

https://usn.ubuntu.com/4078-1/

Source: af854a3a-2127-422b-91ae-364da2661108

Third Party Advisory

https://usn.ubuntu.com/4078-2/

Source: af854a3a-2127-422b-91ae-364da2661108

Third Party Advisory

https://www.openldap.org/its/?findid=9038

Source: af854a3a-2127-422b-91ae-364da2661108

Mailing ListVendor Advisory

https://www.openldap.org/lists/openldap-announce/201907/msg00001.html

Source: af854a3a-2127-422b-91ae-364da2661108

Mailing ListProductVendor Advisory

https://www.oracle.com/security-alerts/cpuapr2020.html

Source: af854a3a-2127-422b-91ae-364da2661108

PatchThird Party Advisory

https://www.oracle.com/security-alerts/cpuapr2022.html

Source: af854a3a-2127-422b-91ae-364da2661108

PatchThird Party Advisory

Timeline

No history available yet.