PT-2011-1193 · Openldap · Openldap
Marcus Meissner
+1
·
Publicado
2011-10-27
·
Atualizado
2023-02-13
·
CVE-2011-4079
CVSS v2.0
6.8
Média
| Vetor | AV:N/AC:M/Au:N/C:P/I:P/A:P |
Name of the Vulnerable Software and Affected Versions
OpenLDAP versions 2.4.26 and earlier
Description
The issue is related to an off-by-one error in the UTF8StringNormalize function, which can be exploited by remote attackers to cause a denial of service (slapd crash) via a zero-length string. This can trigger a heap-based buffer overflow. For example, an empty postalAddressAttribute value in an LDIF entry can be used to demonstrate this issue. Additionally, there are multiple vulnerabilities in the openldap package prior to version 2.4.35 that can lead to violations of confidentiality, integrity, and availability of protected information, and these can be exploited remotely.
Recommendations
For OpenLDAP versions 2.4.26 and earlier, update to a version later than 2.4.26 to resolve the issue.
For openldap package prior to version 2.4.35, update to version 2.4.35 or later to address the multiple vulnerabilities.
Correção
Improper Certificate Validation
Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
Identificadores relacionados
Produtos afetados
Openldap