PT-2006-1534 · Communigate · Communigate Pro Server

Published 2006-01-30 · Updated 2018-10-19 · CVE-2006-0468

Positive Technologies (AI Summary)

CVSS v2.0

7.5

High

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions CommuniGate Pro Server versions 5.0.6 and prior

Description The issue is caused by errors in the LDAP component during handling of negative length values in the Basic Encoding Rules (BER) length fields. This can be exploited to cause a denial of service and may allow arbitrary code execution via a specially-crafted LDAP request. A remote attacker can send a specially formed LDAP packet to cause the denial of service or execute arbitrary code on the target system.

Recommendations For CommuniGate Pro Server versions 5.0.6 and prior, update to version 5.0.7 or later to resolve the issue. As a temporary workaround, consider restricting access to the LDAP component until a patch is available. Avoid using the LDAP component with untrusted input until the issue is resolved.

Exploit

Fix

Related Identifiers

CVE-2006-0468

Affected Products

Communigate Pro Server

References · 14

• 🔥 https://exploit-db.com/exploits/27144 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2006-0468 · Security Note
• http://secunia.com/advisories/18640 · Vendor Advisory
• http://securityfocus.com/bid/16407 · Patch
• http://gleg.net/advisory_cg.shtml · Vendor Advisory
• http://securitylab.ru/vulnerability/261793.php · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/24409 · Note
• http://securityfocus.com/archive/1/423364/100/0/threaded · Note
• http://vupen.com/english/advisories/2006/0364 · Note
• http://lists.grok.org.uk/pipermail/full-disclosure/2006-January/041863.html · Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-0468 · Note
• http://mail.communigate.com/Lists/CGatePro/Message/82832.html · Note
• http://securityfocus.com/archive/1/423364 · Note
• http://stalker.com/CommuniGatePro/History.html · Note