CVE-2010-0212
Fixed in a distro release EPSS 5%
OpenLDAP 2.4.22 allows remote attackers to cause a denial of service (crash) via a modrdn call with a zero-length RDN destination string, which is not properly handled by the smr_normalize function and triggers a NULL pointer dereference in the IA5StringNormalize function in schema_init.c, as demonstrated using the Codenomicon LDAPv3 test suite.
Products: openldap
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| Debian 12 | openldap | 2.4.23-1 |
| Debian 13 | openldap | 2.4.23-1 |
| Debian 14 | openldap | 2.4.23-1 |
| Debian 5.0 | openldap | 2.4.11-1+lenny2 |
| Red Hat Enterprise Linux 5 | compat-openldap | 0:2.3.43_2.2.29-12.el5_5.1 |
| Red Hat Enterprise Linux 5 | openldap | 0:2.3.43-12.el5_5.1 |
| Red Hat Enterprise Linux 5 | openldap-clients | 0:2.3.43-12.el5_5.1 |
| Red Hat Enterprise Linux 5 | openldap-debuginfo | 0:2.3.43-12.el5_5.1 |
| Red Hat Enterprise Linux 5 | openldap-devel | 0:2.3.43-12.el5_5.1 |
| Red Hat Enterprise Linux 5 | openldap-servers | 0:2.3.43-12.el5_5.1 |
| Red Hat Enterprise Linux 5 | openldap-servers-overlays | 0:2.3.43-12.el5_5.1 |
| Red Hat Enterprise Linux 5 | openldap-servers-sql | 0:2.3.43-12.el5_5.1 |