PT-2014-1862 · Openldap+5 · Openldap+5
Michael Vishchers
·
Published
2014-02-03
·
Updated
2016-12-08
·
CVE-2013-4449
CVSS v2.0
4.3
Medium
| Vector | AV:N/AC:M/Au:N/C:N/I:N/A:P |
Name of the Vulnerable Software and Affected Versions
OpenLDAP versions 2.4.23 and earlier
Description
The issue is related to a denial of service (slapd crash) that can be caused by remote attackers. This can happen when the rwm overlay in OpenLDAP does not properly count references, allowing attackers to unbind immediately after a search request. The exploitation can be done remotely and may lead to a disruption in the availability of protected information.
Recommendations
For OpenLDAP version 2.4.23, consider updating to a newer version to resolve the issue.
For versions prior to 2.4.23, update to version 2.4.23 or later to mitigate the risk.
As a temporary workaround, consider restricting access to the rwm overlay until a patch is available.
Fix
DoS
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Alt Linux
Centos
Openldap
Red Hat
Suse
Ubuntu