Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

We use OpenLDAP version 2.4.24

$ /usr/local/libexec/slapd -VV
@(#) $OpenLDAP: slapd 2.4.24 (Mar  5 2011 06:36:43) $
        steve@sunblade2500:/bigdisk/SOURCES/S10/openldap-2.4.24/servers/slapd

OpenLDAP version 2.4.33 is currently available (27.11.2012).

We need to decide if we upgrade

  • expert in OpenLDAP left us
  • are in our version risky vulnerabilities?
  • is there a good web interface to check $SOFTWARE_NAME and $VERSION and see known vulnerabilites with scoring.

I found http://www.cvedetails.com/vulnerability-list/vendor_id-439/Openldap.html but you can't filter $VERSION.

share|improve this question

2 Answers 2

From The OpenLDAP changelog it looks like your current version is from Feb 2011 (OpenLDAP 2.4.24 Release (2011/02/10)), so using the chart on the CVE details site you can see that there's 6 vulns in 2011 and 2012 together.

The highest CVSS rating for any of those is CVE-2011-1025 at 6.8 which looks like it could be a bit nasty depending on what you store in your LDAP bug report here.

So I'd say you'd be best looking through the other 5 vulns, to see whether they affect your installation and if so how much. After that it's a question of weighing the risk of the issues being exploited against the risks posed by upgrading...

share|improve this answer
    
oh yeah - I was looking at how you would automate the search, but this actually answers the question :-) –  Rory Alsop Nov 27 '12 at 15:11

The search functionality in cvedetails.com does let you search on version, but the output is not very handy.

Your best bet with the site is probably to just take the page you linked to and grep through for 2.4.24 to get the associated vulnerabilities.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.