PT-2011-1263 · Ibm · Ibm Tivoli Directory Server

Published 2011-04-21 · Updated 2011-04-21 · CVE-2007-6742

Positive Technologies (AI Summary)

CVSS v2.0

6.8

Medium

Base vector

AV:N/AC:L/Au:S/C:N/I:N/A:C

Name of the Vulnerable Software and Affected Versions IBM Tivoli Directory Server versions prior to 5.2.0.5-TIV-ITDS-LA0006

Description The issue concerns a problem with the get filter list function in IBM Tivoli Directory Server, where it fails to properly parse certain sub filters. This can be exploited by remote authenticated users to cause a denial of service, specifically an infinite loop, by submitting a malformed search filter.

Recommendations For versions prior to 5.2.0.5-TIV-ITDS-LA0006, update to version 5.2.0.5-TIV-ITDS-LA0006 or later to resolve the issue. As a temporary workaround, consider restricting access to the get filter list function to minimize the risk of exploitation.

Fix

Weakness Enumeration

CWE-399

Related Identifiers

CVE-2007-6742

Affected Products

Ibm Tivoli Directory Server

References · 3

• http://ibm.com/support/docview.wss?uid=swg24029663 · Patch
• http://ibm.com/support/docview.wss?uid=swg1IO07450 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2007-6742 · Security Note