OpenLDAP version 2.4.24 at risk? Site to check for known vulnerabilities with version used?

Question

We use OpenLDAP version 2.4.24

$ /usr/local/libexec/slapd -VV
@(#) $OpenLDAP: slapd 2.4.24 (Mar  5 2011 06:36:43) $
        steve@sunblade2500:/bigdisk/SOURCES/S10/openldap-2.4.24/servers/slapd

OpenLDAP version 2.4.33 is currently available (27.11.2012).

We need to decide if we upgrade

• expert in OpenLDAP left us
• are in our version risky vulnerabilities?
• is there a good web interface to check $SOFTWARE_NAME and $VERSION and see known vulnerabilites with scoring.

I found http://www.cvedetails.com/vulnerability-list/vendor_id-439/Openldap.html but you can't filter $VERSION.

Answer 1

From The OpenLDAP changelog it looks like your current version is from Feb 2011 (OpenLDAP 2.4.24 Release (2011/02/10)), so using the chart on the CVE details site you can see that there's 6 vulns in 2011 and 2012 together.

The highest CVSS rating for any of those is CVE-2011-1025 at 6.8 which looks like it could be a bit nasty depending on what you store in your LDAP bug report here.

So I'd say you'd be best looking through the other 5 vulns, to see whether they affect your installation and if so how much. After that it's a question of weighing the risk of the issues being exploited against the risks posed by upgrading...

Answer 2

The search functionality in cvedetails.com does let you search on version, but the output is not very handy.

Your best bet with the site is probably to just take the page you linked to and grep through for 2.4.24 to get the associated vulnerabilities.