PT-2006-7589 · Openldap · Openldap

Evgeny Legerov · Published 1970-01-01 · Updated 2024-02-08 · CVE-2006-5779

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Medium

Base vector

AV:N/AC:L/Au:N/C:N/I:N/A:P

Name of the Vulnerable Software and Affected Versions OpenLDAP versions prior to 2.3.29

Description The issue allows remote attackers to cause a denial of service, resulting in a daemon crash, via LDAP BIND requests with long authcid names. This triggers an assertion failure, leading to a disruption in the availability of protected information. The exploitation of this issue can be carried out remotely.

Recommendations For OpenLDAP versions prior to 2.3.29, update to version 2.3.29 or later to resolve the issue. As a temporary workaround, consider restricting access to LDAP BIND requests to minimize the risk of exploitation.

Exploit

Fix

Assertion Failure

Weakness Enumeration

CWE-617

Related Identifiers

BDU:2015-04656

BDU:2015-04657

BDU:2015-04658

BDU:2015-04659

BDU:2015-04933

BDU:2015-04934

BDU:2015-04935

BDU:2015-04936

BDU:2015-09541

CVE-2006-5779

Affected Products

Openldap

References · 35

• 🔥 http://securitytracker.com/id?1017166 · Exploit
• 🔥 http://gleg.net/vulndisco_meta.shtml · Exploit
• 🔥 http://securityfocus.com/bid/20939 · Exploit
• 🔥 http://openldap.org/its/index.cgi/Software%20Bugs?id=4740 · Exploit
• 🔥 http://gleg.net/downloads/VULNDISCO_META_FREE.tar.gz · Exploit
• https://bdu.fstec.ru/vul/2015-04657 · Security Note
• https://bdu.fstec.ru/vul/2015-04656 · Security Note
• http://secunia.com/advisories/23133 · Vendor Advisory
• http://mandriva.com/security/advisories?name=MDKSA-2006:208 · Vendor Advisory
• http://secunia.com/advisories/23125 · Vendor Advisory
• http://security.gentoo.org/glsa/glsa-200611-25.xml · Vendor Advisory
• http://vupen.com/english/advisories/2006/4379 · Vendor Advisory
• https://bdu.fstec.ru/vul/2015-09541 · Security Note
• https://bdu.fstec.ru/vul/2015-04659 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2006-5779 · Security Note