PT-2011-1263 · Ibm · Ibm Tivoli Directory Server

Publicado 2011-04-21 · Atualizado 2011-04-21 · CVE-2007-6742

Positive Technologies (AI Summary)

CVSS v2.0

6.8

Média

Vetor base

AV:N/AC:L/Au:S/C:N/I:N/A:C

Name of the Vulnerable Software and Affected Versions IBM Tivoli Directory Server versions prior to 5.2.0.5-TIV-ITDS-LA0006

Description The issue concerns a problem with the get filter list function in IBM Tivoli Directory Server, where it fails to properly parse certain sub filters. This can be exploited by remote authenticated users to cause a denial of service, specifically an infinite loop, by submitting a malformed search filter.

Recommendations For versions prior to 5.2.0.5-TIV-ITDS-LA0006, update to version 5.2.0.5-TIV-ITDS-LA0006 or later to resolve the issue. As a temporary workaround, consider restricting access to the get filter list function to minimize the risk of exploitation.

Correção

Enumeração de Fraquezas

CWE-399

Identificadores relacionados

CVE-2007-6742

Produtos afetados

Ibm Tivoli Directory Server

Referências · 3

• http://ibm.com/support/docview.wss?uid=swg24029663 · Correção
• http://ibm.com/support/docview.wss?uid=swg1IO07450 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2007-6742 · Nota de Segurança