CVE-2002-1379 Code injection in n/a
Remote or local attackers can execute arbitrary code with elevated privileges via the libldap library when it reads a malicious .ldaprc file.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2002-1379?
CVE-2002-1379 is a high-severity code injection vulnerability in Openldap Openldap, published on 17 Dec 2002. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
OpenLDAP2 (OpenLDAP 2) 2.2.0 and earlier allows remote or local attackers to execute arbitrary code when libldap reads the .ldaprc file within applications that are running with extra privileges.
Which versions are affected by CVE-2002-1379?
It affects 1 product.
Products include Openldap Openldap.
How do I fix CVE-2002-1379?
Upgrade to a fixed version.
Upgrade, and never evaluate templates, expressions or code built from user input. More about Code injection.
Is CVE-2002-1379 being exploited?
There is no known exploitation of CVE-2002-1379 in the wild and no public exploit code.
Other vulnerabilities in Openldap Openldap
Sources
Also known as GHSA-63p4-p8mv-xhx7.