CVE-2014-4668 The cherokee_validator_ldap_check function in validator_ldap.c in Cherokee 1.2.103 and earlier, when LDAP is used, does not properly consider unauthenticated-bind semantics, which allows remote attack...
MediumCVSS 6.8
EPSS 2.8%
- Published
- Updated
- Exploit status
- No public exploit known
Description
The cherokee_validator_ldap_check function in validator_ldap.c in Cherokee 1.2.103 and earlier, when LDAP is used, does not properly consider unauthenticated-bind semantics, which allows remote attackers to bypass authentication via an empty password.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| fedoraproject fedora | = 20 | No fix listed |
| fedoraproject fedora | = 21 | No fix listed |
| fedoraproject fedora | = 22 | No fix listed |
| mageia project mageia | = 4 | No fix listed |
| cherokee-project cherokee | <= 1.2.103 | No fix listed |
| cherokee-project cherokee | = 1.2.2 | No fix listed |
| cherokee-project cherokee | = 1.2.98 | No fix listed |
| cherokee-project cherokee | = 1.2.99 | No fix listed |
| cherokee-project cherokee | = 1.2.101 | No fix listed |
| cherokee-project cherokee | = 1.2.102 | No fix listed |
References
- advisories.mageia.org
- FEDORA-2015-6194 vendor-advisory
- FEDORA-2015-6279 vendor-advisory
- FEDORA-2015-6392 vendor-advisory
- [oss-security] 20140628 CVE request / advisory: Cherokee mailing-list
- [oss-security] 20140628 Re: CVE request / advisory: Cherokee mailing-list
- MDVSA-2015:225 vendor-advisory
- 68249 vdb-entry
- github.com