PT-2006-7097 · Openldap · Openldap

Publicado 2006-12-13 · Atualizado 2011-03-08 · CVE-2006-6493

Positive Technologies (AI Summary)

CVSS v2.0

5.1

Média

Vetor base

AV:N/AC:H/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions OpenLDAP versions 2.4.3 and earlier

Description A buffer overflow issue exists in the krbv4 ldap auth function, which can be exploited by remote attackers to execute arbitrary code. This occurs when OpenLDAP is compiled with the --enable-kbind option and an LDAP bind request is made using the LDAP AUTH KRBV41 authentication method with long credential data.

Recommendations For OpenLDAP versions 2.4.3 and earlier, consider disabling the Kerberos KBIND option as a temporary workaround until a patch is available. Restrict access to the krbv4 ldap auth function to minimize the risk of exploitation. Avoid using the LDAP AUTH KRBV41 authentication method in the affected LDAP bind request until the issue is resolved.

Exploit

Correção

Identificadores relacionados

CVE-2006-6493

Produtos afetados

Openldap

Referências · 7

• 🔥 http://phreedom.org/solar/exploits/openldap-kbind · Exploit
• 🔥 http://securityfocus.com/archive/1/454181/30/0/threaded · Exploit
• 🔥 https://exploit-db.com/exploits/2933 · Exploit
• http://securityreason.com/securityalert/2023 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2006-6493 · Nota de Segurança
• http://secunia.com/advisories/23334 · Nota
• http://vupen.com/english/advisories/2006/4964 · Nota