Description
slapd in OpenLDAP before 2.3.25 allows remote authenticated users with selfwrite Access Control List (ACL) privileges to modify arbitrary Distinguished Names (DN).
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 4 | compat-openldap | 2.1.30-7.4E | RHSA-2007:0310 |
| RHEL 4 | openldap +4 | 2.2.13-7.4E | RHSA-2007:0310 |
| RHEL 3 | openldap +3 | 2.0.27-23 | RHSA-2007:0430 |
Advisories 2
- RHSA-2007:0430 Red Hat Security Advisory: openldap security and bug-fix update Red Hat Security Advisories (RHSA) · Jun 26, 2026
- RHSA-2007:0310 Red Hat Security Advisory: openldap security update Red Hat Security Advisories (RHSA) · Jun 26, 2026
References
- http://support.avaya.com/elmodocs2/security/ASA-2007-232.htm
- 22300 third-party-advisory
- 20070920 VMSA-2007-0006 Critical security updates for all supported versions of VMware ESX Server, VMware Server, VMware Workstation, VMware ACE, and VMware Player mailing-list
- MDKSA-2006:171 vendor-advisory
- 25098 third-party-advisory
- GLSA-200711-23 vendor-advisory
- 25894 third-party-advisory
- [openldap-announce] 20060801 OpenLDAP 2.3.25 available mailing-list
- https://issues.rpath.com/browse/RPL-667
- ADV-2007-3229 vdb-entry
- 2006-0055 vendor-advisory
- 20060929 rPSA-2006-0176-1 openldap openldap-clients openldap-servers mailing-list
- 22273 third-party-advisory
- 25628 third-party-advisory
- http://www.openldap.org/its/index.cgi/Software%20Bugs?id=4587
- RHSA-2007:0430 vendor-advisory
- ADV-2007-2186 vdb-entry
- openldap-selfwrite-security-bypass(28772) vdb-entry
- oval:org.mitre.oval:def:9618 vdb-entry signature
- 19832 vdb-entry
- RHSA-2007:0310 vendor-advisory
- 26909 third-party-advisory
- 27706 third-party-advisory
- 1016783 vdb-entry
- http://www.openldap.org/software/release/changes.html
- 22219 third-party-advisory
- 25676 third-party-advisory
- 21721 third-party-advisory