Description
The slap_modrdn2mods function in modrdn.c in OpenLDAP 2.4.22 does not check the return value of a call to the smr_normalize function, which allows remote attackers to cause a denial of service (segmentation fault) and possibly execute arbitrary code via a modrdn call with an RDN string containing invalid UTF-8 sequences, which triggers a free of an invalid, uninitialized pointer in the slap_mods_free function, as demonstrated using the Codenomicon LDAPv3 test suite.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | openldap | 2.4.23-1 | — |
| Debian 13 | openldap | 2.4.23-1 | — |
| Debian 12 | openldap | 2.4.23-1 | — |
| Debian 5.0 | openldap | 2.4.11-1+lenny2 | DSA-2077-1 |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 5 | compat-openldap | 2.3.43_2.2.29-12.el5_5.1 | RHSA-2010:0542 |
| RHEL 5 | openldap +5 | 2.3.43-12.el5_5.1 | RHSA-2010:0542 |
| RHEL 4 | compat-openldap | 2.1.30-12.el4_8.3 | RHSA-2010:0543 |
| RHEL 4 | openldap +4 | 2.2.13-12.el4_8.3 | RHSA-2010:0543 |
Public exploits
Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.
Exploit-DB 1
- OpenLDAP 2.4.22 - 'modrdn' Multiple Vulnerabilities EDB-34348 · dos · Jul 19, 2010 · verified
Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.
Advisories 3
- RHSA-2010:0542 Red Hat Security Advisory: openldap security update Red Hat Security Advisories (RHSA) · Jun 26, 2026
- RHSA-2010:0543 Red Hat Security Advisory: openldap security update Red Hat Security Advisories (RHSA) · Jun 26, 2026
- DSA-2077-1 openldap - potential code execution Debian Security (DSA / DLA) · Mar 9, 2026
References
- 1024221 vdb-entry
- http://support.apple.com/kb/HT4435
- GLSA-201406-36 vendor-advisory
- http://www.openldap.org/its/index.cgi/Software%20Bugs?id=6570
- http://www.vmware.com/security/advisories/VMSA-2011-0001.html
- ADV-2010-1858 vdb-entry
- 40677 third-party-advisory
- APPLE-SA-2010-11-10-1 vendor-advisory
- ADV-2010-1849 vdb-entry
- 41770 vdb-entry
- RHSA-2010:0542 vendor-advisory
- 40687 third-party-advisory
- 20110105 VMSA-2011-0001 VMware ESX third party updates for Service Console packages glibc, sudo, and openldap mailing-list
- SUSE-SR:2010:014 vendor-advisory
- RHSA-2010:0543 vendor-advisory
- http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10705
- 40639 third-party-advisory
- 42787 third-party-advisory
- ADV-2011-0025 vdb-entry