PT-2008-4368 · Red Hat+2 · Red Hat Directory Server+2

Ulf Weltman · Published 2008-08-29 · Updated 2017-09-29 · CVE-2008-2930

Positive Technologies (AI Summary)

CVSS v2.0

7.1

High

Base vector

AV:N/AC:M/Au:N/C:N/I:N/A:C

Name of the Vulnerable Software and Affected Versions Red Hat Directory Server versions 7.1 before SP7 Red Hat Directory Server version 8 Fedora Directory Server version 1.1.1

Description The issue allows remote attackers to cause a denial of service, resulting in CPU consumption and search outage, via crafted LDAP search requests with patterns. This is related to a single-threaded regular-expression subsystem.

Recommendations For Red Hat Directory Server versions 7.1 before SP7, update to SP7 or later to resolve the issue. For Red Hat Directory Server version 8, consider restricting access to the LDAP search functionality until a patch is available. For Fedora Directory Server version 1.1.1, restrict access to the vulnerable regular-expression subsystem to minimize the risk of exploitation.

Exploit

Fix

DoS

Weakness Enumeration

CWE-399

Related Identifiers

CVE-2008-2930

HPSBUX02354

RHSA-2008:0596

RHSA-2008:0602

RHSA-2008:0858

Affected Products

Fedora Directory Server

Hp-Ux

Red Hat Directory Server

References · 24

• 🔥 https://exploit-db.com/exploits/32304 · Exploit
• https://redhat.com/archives/fedora-package-announce/2008-September/msg00708.html · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2008-2930 · Security Note
• https://rhn.redhat.com/errata/RHSA-2008-0596.html · Vendor Advisory
• http://redhat.com/support/errata/RHSA-2008-0602.html · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-2928 · Security Note
• https://redhat.com/archives/fedora-package-announce/2008-September/msg00521.html · Vendor Advisory
• http://securityfocus.com/bid/30871 · Patch
• http://redhat.com/support/errata/RHSA-2008-0858.html · Vendor Advisory
• http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c01532861 · Vendor Advisory
• http://redhat.com/docs/manuals/dir-server/release-notes/7.1SP7/index.html · Patch
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-2929 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-3283 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-2930 · Security Note
• http://vupen.com/english/advisories/2008/2480 · Note