Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
5.0

OpenLDAP 2.4.22 can crash with a malformed rename request

CVE-2010-0212 · published 16 years ago
Summary

The OpenLDAP 2.4.22 package included in Debian can stop working if it receives a specially crafted rename operation that contains an empty name field. When this occurs, the service crashes and becomes unavailable to users and applications. Upgrade OpenLDAP to a newer version or apply the Debian security patch to eliminate the problem.

What to do
  • Update debian openldap to version 2.4.23-1.
Affected software
Ecosystem VendorProductAffected versions
Debian:12 debian openldap < 2.4.23-1
Fix: upgrade to 2.4.23-1
Debian:13 debian openldap < 2.4.23-1
Fix: upgrade to 2.4.23-1
Debian:14 debian openldap < 2.4.23-1
Fix: upgrade to 2.4.23-1
– openldap openldap 2.4.22
cpe:2.3:a:openldap:openldap:2.4.22:*:*:*:*:*:*:*
Original advisory text
OpenLDAP 2.4.22 allows remote attackers to cause a denial of service (crash) via a modrdn call with a zero-length RDN destination string, which is not properly handled by the smr_normalize function...
OpenLDAP 2.4.22 allows remote attackers to cause a denial of service (crash) via a modrdn call with a zero-length RDN destination string, which is not properly handled by the smr_normalize function and triggers a NULL pointer dereference in the IA5StringNormalize function in schema_init.c, as demonstrated using the Codenomicon LDAPv3 test suite.
References
Severity
5.0 Medium
Exploitation
5% chance of attack within 30 days
Type
CWE-264Permissions, Privileges, and Access Controls
Timeline
Published28 Jul 2010
Updated30 Oct 2026
First seen23 Sep 2026
Sources
DEBIAN-CVE-2010-0212 · OSV
CVE-2010-0212 · NVD
Track software like this
Free during beta