The version of openldap installed on the remote host is prior to 2.4.40-16.36. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS-2023-1741 advisory.
An issue was discovered in OpenLDAP 2.x before 2.4.48. When using SASL authentication and session encryption, and relying on the SASL security layers in slapd access controls, it is possible to obtain access that would otherwise be denied via a simple bind for any identity covered in those ACLs. After the first SASL bind is completed, the sasl_ssf value is retained for all new non-SASL connections. Depending on the ACL configuration, this can affect different types of operations (searches, modifications, etc.).
In other words, a successful authorization step completed by one user affects the authorization requirement for a different user. (CVE-2019-13565)
An integer underflow was discovered in OpenLDAP before 2.4.57 leading to slapd crashes in the Certificate Exact Assertion processing, resulting in denial of service (schema_init.c serialNumberAndIssuerCheck).
(CVE-2020-36221)
A flaw was discovered in OpenLDAP before 2.4.57 leading to an assertion failure in slapd in the saslAuthzTo validation, resulting in denial of service. (CVE-2020-36222)
A flaw was discovered in OpenLDAP before 2.4.57 leading to a slapd crash in the Values Return Filter control handling, resulting in denial of service (double free and out-of-bounds read). (CVE-2020-36223)
A flaw was discovered in OpenLDAP before 2.4.57 leading to an invalid pointer free and slapd crash in the saslAuthzTo processing, resulting in denial of service. (CVE-2020-36224)
A flaw was discovered in OpenLDAP before 2.4.57 leading to a double free and slapd crash in the saslAuthzTo processing, resulting in denial of service. (CVE-2020-36225)
A flaw was discovered in OpenLDAP before 2.4.57 leading to a memch->bv_len miscalculation and slapd crash in the saslAuthzTo processing, resulting in denial of service. (CVE-2020-36226)
A flaw was discovered in OpenLDAP before 2.4.57 leading to an infinite loop in slapd with the cancel_extop Cancel operation, resulting in denial of service. (CVE-2020-36227)
An integer underflow was discovered in OpenLDAP before 2.4.57 leading to a slapd crash in the Certificate List Exact Assertion processing, resulting in denial of service. (CVE-2020-36228)
A flaw was discovered in ldap_X509dn2bv in OpenLDAP before 2.4.57 leading to a slapd crash in the X.509 DN parsing in ad_keystring, resulting in denial of service. (CVE-2020-36229)
A flaw was discovered in OpenLDAP before 2.4.57 leading in an assertion failure in slapd in the X.509 DN parsing in decode.c ber_next_element, resulting in denial of service. (CVE-2020-36230)
In OpenLDAP through 2.4.57 and 2.5.x through 2.5.1alpha, an assertion failure in slapd can occur in the issuerAndThisUpdateCheck function via a crafted packet, resulting in a denial of service (daemon exit) via a short timestamp. This is related to schema_init.c and checkTime. (CVE-2021-27212)
Note that Nessus has not tested for these issues but has instead relied only on the application’s self-reported version number.
#%NASL_MIN_LEVEL 80900
##
# (C) Tenable, Inc.
#
# The descriptive text and package checks in this plugin were
# extracted from Amazon Linux AMI Security Advisory ALAS-2023-1741.
##
include('compat.inc');
if (description)
{
script_id(175093);
script_version("1.1");
script_set_attribute(attribute:"plugin_modification_date", value:"2023/05/05");
script_cve_id(
"CVE-2019-13565",
"CVE-2020-36221",
"CVE-2020-36222",
"CVE-2020-36223",
"CVE-2020-36224",
"CVE-2020-36225",
"CVE-2020-36226",
"CVE-2020-36227",
"CVE-2020-36228",
"CVE-2020-36229",
"CVE-2020-36230",
"CVE-2021-27212"
);
script_xref(name:"IAVB", value:"2021-B-0014");
script_name(english:"Amazon Linux AMI : openldap (ALAS-2023-1741)");
script_set_attribute(attribute:"synopsis", value:
"The remote Amazon Linux AMI host is missing a security update.");
script_set_attribute(attribute:"description", value:
"The version of openldap installed on the remote host is prior to 2.4.40-16.36. It is, therefore, affected by multiple
vulnerabilities as referenced in the ALAS-2023-1741 advisory.
- An issue was discovered in OpenLDAP 2.x before 2.4.48. When using SASL authentication and session
encryption, and relying on the SASL security layers in slapd access controls, it is possible to obtain
access that would otherwise be denied via a simple bind for any identity covered in those ACLs. After the
first SASL bind is completed, the sasl_ssf value is retained for all new non-SASL connections. Depending
on the ACL configuration, this can affect different types of operations (searches, modifications, etc.).
In other words, a successful authorization step completed by one user affects the authorization
requirement for a different user. (CVE-2019-13565)
- An integer underflow was discovered in OpenLDAP before 2.4.57 leading to slapd crashes in the Certificate
Exact Assertion processing, resulting in denial of service (schema_init.c serialNumberAndIssuerCheck).
(CVE-2020-36221)
- A flaw was discovered in OpenLDAP before 2.4.57 leading to an assertion failure in slapd in the
saslAuthzTo validation, resulting in denial of service. (CVE-2020-36222)
- A flaw was discovered in OpenLDAP before 2.4.57 leading to a slapd crash in the Values Return Filter
control handling, resulting in denial of service (double free and out-of-bounds read). (CVE-2020-36223)
- A flaw was discovered in OpenLDAP before 2.4.57 leading to an invalid pointer free and slapd crash in the
saslAuthzTo processing, resulting in denial of service. (CVE-2020-36224)
- A flaw was discovered in OpenLDAP before 2.4.57 leading to a double free and slapd crash in the
saslAuthzTo processing, resulting in denial of service. (CVE-2020-36225)
- A flaw was discovered in OpenLDAP before 2.4.57 leading to a memch->bv_len miscalculation and slapd crash
in the saslAuthzTo processing, resulting in denial of service. (CVE-2020-36226)
- A flaw was discovered in OpenLDAP before 2.4.57 leading to an infinite loop in slapd with the cancel_extop
Cancel operation, resulting in denial of service. (CVE-2020-36227)
- An integer underflow was discovered in OpenLDAP before 2.4.57 leading to a slapd crash in the Certificate
List Exact Assertion processing, resulting in denial of service. (CVE-2020-36228)
- A flaw was discovered in ldap_X509dn2bv in OpenLDAP before 2.4.57 leading to a slapd crash in the X.509 DN
parsing in ad_keystring, resulting in denial of service. (CVE-2020-36229)
- A flaw was discovered in OpenLDAP before 2.4.57 leading in an assertion failure in slapd in the X.509 DN
parsing in decode.c ber_next_element, resulting in denial of service. (CVE-2020-36230)
- In OpenLDAP through 2.4.57 and 2.5.x through 2.5.1alpha, an assertion failure in slapd can occur in the
issuerAndThisUpdateCheck function via a crafted packet, resulting in a denial of service (daemon exit) via
a short timestamp. This is related to schema_init.c and checkTime. (CVE-2021-27212)
Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version
number.");
script_set_attribute(attribute:"see_also", value:"https://alas.aws.amazon.com/ALAS-2023-1741.html");
script_set_attribute(attribute:"see_also", value:"https://alas.aws.amazon.com/cve/html/CVE-2019-13565.html");
script_set_attribute(attribute:"see_also", value:"https://alas.aws.amazon.com/cve/html/CVE-2020-36221.html");
script_set_attribute(attribute:"see_also", value:"https://alas.aws.amazon.com/cve/html/CVE-2020-36222.html");
script_set_attribute(attribute:"see_also", value:"https://alas.aws.amazon.com/cve/html/CVE-2020-36223.html");
script_set_attribute(attribute:"see_also", value:"https://alas.aws.amazon.com/cve/html/CVE-2020-36224.html");
script_set_attribute(attribute:"see_also", value:"https://alas.aws.amazon.com/cve/html/CVE-2020-36225.html");
script_set_attribute(attribute:"see_also", value:"https://alas.aws.amazon.com/cve/html/CVE-2020-36226.html");
script_set_attribute(attribute:"see_also", value:"https://alas.aws.amazon.com/cve/html/CVE-2020-36227.html");
script_set_attribute(attribute:"see_also", value:"https://alas.aws.amazon.com/cve/html/CVE-2020-36228.html");
script_set_attribute(attribute:"see_also", value:"https://alas.aws.amazon.com/cve/html/CVE-2020-36229.html");
script_set_attribute(attribute:"see_also", value:"https://alas.aws.amazon.com/cve/html/CVE-2020-36230.html");
script_set_attribute(attribute:"see_also", value:"https://alas.aws.amazon.com/cve/html/CVE-2021-27212.html");
script_set_attribute(attribute:"see_also", value:"https://alas.aws.amazon.com/faqs.html");
script_set_attribute(attribute:"solution", value:
"Run 'yum update openldap' to update your system.");
script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:N/C:P/I:N/A:N");
script_set_cvss_temporal_vector("CVSS2#E:POC/RL:OF/RC:C");
script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N");
script_set_cvss3_temporal_vector("CVSS:3.0/E:P/RL:O/RC:C");
script_set_attribute(attribute:"cvss_score_source", value:"CVE-2019-13565");
script_set_attribute(attribute:"exploitability_ease", value:"Exploits are available");
script_set_attribute(attribute:"exploit_available", value:"true");
script_set_attribute(attribute:"vuln_publication_date", value:"2019/07/26");
script_set_attribute(attribute:"patch_publication_date", value:"2023/04/27");
script_set_attribute(attribute:"plugin_publication_date", value:"2023/05/04");
script_set_attribute(attribute:"plugin_type", value:"local");
script_set_attribute(attribute:"cpe", value:"p-cpe:/a:amazon:linux:openldap");
script_set_attribute(attribute:"cpe", value:"p-cpe:/a:amazon:linux:openldap-clients");
script_set_attribute(attribute:"cpe", value:"p-cpe:/a:amazon:linux:openldap-debuginfo");
script_set_attribute(attribute:"cpe", value:"p-cpe:/a:amazon:linux:openldap-devel");
script_set_attribute(attribute:"cpe", value:"p-cpe:/a:amazon:linux:openldap-servers");
script_set_attribute(attribute:"cpe", value:"p-cpe:/a:amazon:linux:openldap-servers-sql");
script_set_attribute(attribute:"cpe", value:"cpe:/o:amazon:linux");
script_set_attribute(attribute:"generated_plugin", value:"current");
script_set_attribute(attribute:"stig_severity", value:"I");
script_end_attributes();
script_category(ACT_GATHER_INFO);
script_family(english:"Amazon Linux Local Security Checks");
script_copyright(english:"This script is Copyright (C) 2023 and is owned by Tenable, Inc. or an Affiliate thereof.");
script_dependencies("ssh_get_info.nasl");
script_require_keys("Host/local_checks_enabled", "Host/AmazonLinux/release", "Host/AmazonLinux/rpm-list");
exit(0);
}
include("rpm.inc");
if (!get_kb_item("Host/local_checks_enabled")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);
var alas_release = get_kb_item("Host/AmazonLinux/release");
if (isnull(alas_release) || !strlen(alas_release)) audit(AUDIT_OS_NOT, "Amazon Linux");
var os_ver = pregmatch(pattern: "^AL(A|\d+|-\d+)", string:alas_release);
if (isnull(os_ver)) audit(AUDIT_UNKNOWN_APP_VER, "Amazon Linux");
os_ver = os_ver[1];
if (os_ver != "A")
{
if (os_ver == 'A') os_ver = 'AMI';
audit(AUDIT_OS_NOT, "Amazon Linux AMI", "Amazon Linux " + os_ver);
}
if (!get_kb_item("Host/AmazonLinux/rpm-list")) audit(AUDIT_PACKAGE_LIST_MISSING);
var pkgs = [
{'reference':'openldap-2.4.40-16.36.amzn1', 'cpu':'i686', 'release':'ALA', 'rpm_spec_vers_cmp':TRUE},
{'reference':'openldap-2.4.40-16.36.amzn1', 'cpu':'x86_64', 'release':'ALA', 'rpm_spec_vers_cmp':TRUE},
{'reference':'openldap-clients-2.4.40-16.36.amzn1', 'cpu':'i686', 'release':'ALA', 'rpm_spec_vers_cmp':TRUE},
{'reference':'openldap-clients-2.4.40-16.36.amzn1', 'cpu':'x86_64', 'release':'ALA', 'rpm_spec_vers_cmp':TRUE},
{'reference':'openldap-debuginfo-2.4.40-16.36.amzn1', 'cpu':'i686', 'release':'ALA', 'rpm_spec_vers_cmp':TRUE},
{'reference':'openldap-debuginfo-2.4.40-16.36.amzn1', 'cpu':'x86_64', 'release':'ALA', 'rpm_spec_vers_cmp':TRUE},
{'reference':'openldap-devel-2.4.40-16.36.amzn1', 'cpu':'i686', 'release':'ALA', 'rpm_spec_vers_cmp':TRUE},
{'reference':'openldap-devel-2.4.40-16.36.amzn1', 'cpu':'x86_64', 'release':'ALA', 'rpm_spec_vers_cmp':TRUE},
{'reference':'openldap-servers-2.4.40-16.36.amzn1', 'cpu':'i686', 'release':'ALA', 'rpm_spec_vers_cmp':TRUE},
{'reference':'openldap-servers-2.4.40-16.36.amzn1', 'cpu':'x86_64', 'release':'ALA', 'rpm_spec_vers_cmp':TRUE},
{'reference':'openldap-servers-sql-2.4.40-16.36.amzn1', 'cpu':'i686', 'release':'ALA', 'rpm_spec_vers_cmp':TRUE},
{'reference':'openldap-servers-sql-2.4.40-16.36.amzn1', 'cpu':'x86_64', 'release':'ALA', 'rpm_spec_vers_cmp':TRUE}
];
var flag = 0;
foreach var package_array ( pkgs ) {
var reference = NULL;
var _release = NULL;
var sp = NULL;
var _cpu = NULL;
var el_string = NULL;
var rpm_spec_vers_cmp = NULL;
var epoch = NULL;
var allowmaj = NULL;
var exists_check = NULL;
if (!empty_or_null(package_array['reference'])) reference = package_array['reference'];
if (!empty_or_null(package_array['release'])) _release = package_array['release'];
if (!empty_or_null(package_array['sp'])) sp = package_array['sp'];
if (!empty_or_null(package_array['cpu'])) _cpu = package_array['cpu'];
if (!empty_or_null(package_array['el_string'])) el_string = package_array['el_string'];
if (!empty_or_null(package_array['rpm_spec_vers_cmp'])) rpm_spec_vers_cmp = package_array['rpm_spec_vers_cmp'];
if (!empty_or_null(package_array['epoch'])) epoch = package_array['epoch'];
if (!empty_or_null(package_array['allowmaj'])) allowmaj = package_array['allowmaj'];
if (!empty_or_null(package_array['exists_check'])) exists_check = package_array['exists_check'];
if (reference && _release && (!exists_check || rpm_exists(release:_release, rpm:exists_check))) {
if (rpm_check(release:_release, sp:sp, cpu:_cpu, reference:reference, epoch:epoch, el_string:el_string, rpm_spec_vers_cmp:rpm_spec_vers_cmp, allowmaj:allowmaj)) flag++;
}
}
if (flag)
{
security_report_v4(
port : 0,
severity : SECURITY_WARNING,
extra : rpm_report_get()
);
exit(0);
}
else
{
var tested = pkg_tests_get();
if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);
else audit(AUDIT_PACKAGE_NOT_INSTALLED, "openldap / openldap-clients / openldap-debuginfo / etc");
}
cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-13565
cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-36221
cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-36222
cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-36223
cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-36224
cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-36225
cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-36226
cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-36227
cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-36228
cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-36229
cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-36230
cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-27212
alas.aws.amazon.com/ALAS-2023-1741.html
alas.aws.amazon.com/cve/html/CVE-2019-13565.html
alas.aws.amazon.com/cve/html/CVE-2020-36221.html
alas.aws.amazon.com/cve/html/CVE-2020-36222.html
alas.aws.amazon.com/cve/html/CVE-2020-36223.html
alas.aws.amazon.com/cve/html/CVE-2020-36224.html
alas.aws.amazon.com/cve/html/CVE-2020-36225.html
alas.aws.amazon.com/cve/html/CVE-2020-36226.html
alas.aws.amazon.com/cve/html/CVE-2020-36227.html
alas.aws.amazon.com/cve/html/CVE-2020-36228.html
alas.aws.amazon.com/cve/html/CVE-2020-36229.html
alas.aws.amazon.com/cve/html/CVE-2020-36230.html
alas.aws.amazon.com/cve/html/CVE-2021-27212.html
alas.aws.amazon.com/faqs.html