PT-2012-1160 · Openldap+3 · Openldap+3

Mattias Andersson · Published 2012-06-19 · Updated 2017-01-07 · CVE-2012-1164

Positive Technologies (AI Summary)

CVSS v2.0

6.8

Medium

Base vector

AV:N/AC:M/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions OpenLDAP versions prior to 2.4.30

Description The issue allows remote attackers to cause a denial of service, leading to an assertion failure and daemon exit, via an LDAP search query with attrsOnly set to true. This results in empty attributes being returned. The vulnerability can be exploited remotely and may lead to disruption of confidentiality, integrity, and availability of protected information.

Recommendations For versions prior to 2.4.30, update to version 2.4.30 or later to resolve the issue. As a temporary workaround, consider restricting access to LDAP search queries with attrsOnly set to true until a patch is available.

Fix

DoS

Improper Certificate Validation

Buffer Overflow

Weakness Enumeration

CWE-295

CWE-119

Related Identifiers

BDU:2015-09683

CESA-2012_0899

CVE-2012-1164

DLA-203-1

RHSA-2012:0899

RHSA-2012_0899

USN-2622-1

Affected Products

Centos

Openldap

Red Hat

Ubuntu

References · 47

• https://bdu.fstec.ru/vul/2015-07066 · Security Note
• https://osv.dev/vulnerability/DEBIAN-CVE-2012-1164 · Vendor Advisory
• http://openldap.org/its/index.cgi/Software%20Bugs?id=7143 · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-1545 · Security Note
• https://ubuntu.com/security/CVE-2012-1164 · Vendor Advisory
• https://linux.oracle.com/errata/ELSA-2012-0899.html · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2012-1164 · Vendor Advisory
• https://ubuntu.com/security/CVE-2013-4449 · Vendor Advisory
• https://bdu.fstec.ru/vul/2015-07061 · Security Note
• http://security.gentoo.org/glsa/glsa-201406-36.xml · Vendor Advisory
• https://bdu.fstec.ru/vul/2015-09062 · Security Note
• https://bdu.fstec.ru/vul/2015-09064 · Security Note
• https://bdu.fstec.ru/vul/2015-09065 · Security Note
• https://ubuntu.com/security/notices/USN-2622-1 · Vendor Advisory
• https://bdu.fstec.ru/vul/2015-07068 · Security Note