PT-2008-4366 · Red Hat+1 · Red Hat Directory Server+2

Publicado 2008-08-29 · Atualizado 2017-09-29 · CVE-2008-2928

Positive Technologies (AI Summary)

CVSS v2.0

10

Alta

Vetor base

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Red Hat Directory Server version 7.1 before SP7

Description The issue is related to multiple buffer overflows in the adminutil library used by CGI applications. This can be exploited by remote attackers through a crafted Accept-Language HTTP header, potentially leading to a denial of service (daemon crash) or the execution of arbitrary code.

Recommendations For Red Hat Directory Server version 7.1 before SP7, update to SP7 or later to resolve the issue.

Correção

DoS

Buffer Overflow

Enumeração de Fraquezas

CWE-119

Identificadores relacionados

CVE-2008-2928

HPSBUX02354

RHSA-2008:0596

Produtos afetados

Hp-Ux

Red Hat Directory Server

Adminutil

Referências · 20

• http://vupen.com/english/advisories/2008/2480 · Nota
• http://secunia.com/advisories/31777 · Nota
• https://redhat.com/archives/fedora-package-announce/2008-September/msg00449.html · Aviso do Fabricante
• https://exchange.xforce.ibmcloud.com/vulnerabilities/44738 · Nota
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-2928 · Nota de Segurança
• http://secunia.com/advisories/31702 · Nota
• http://h20565.www2.hp.com/portal/site/hpsc/template.PAGE/action.process/public/kb/docDisplay/?javax.portlet.action=true&spf_p.tpst=kbDocDisplay&javax.portlet.begCacheTok=com.vignette.cachetoken&spf_p.prp_kbDocDisplay=wsrp-interactionState%3DdocId%253DZW1yX25hLWMwMTUzMjg2MQ%2525253D%2525253DhPsCeNc%257CdocLocale%253Den_US%257CcalledBy%253D&javax.portlet.endCacheTok=com.vignette.cachetoken · Nota
• http://secunia.com/advisories/31565 · Nota
• https://rhn.redhat.com/errata/RHSA-2008-0596.html · Correção, Aviso do Fabricante
• https://redhat.com/archives/fedora-package-announce/2008-September/msg00218.html · Aviso do Fabricante
• http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c01532861 · Aviso do Fabricante
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-2929 · Nota de Segurança
• http://securitytracker.com/id?1020771 · Nota
• http://redhat.com/docs/manuals/dir-server/release-notes/7.1SP7/index.html · Nota
• https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A5865 · Nota