[SECURITY] [DSA 1943-1] New openldap2.3/openldap packages fix SSL certificate verification weakness

------------------------------------------------------------------------ Debian Security Advisory DSA-1943 [email protected] http://www.debian.org/security/ Giuseppe Iuculano December 02, 2009 http://www.debian.org/security/faq -...

DSA-1943-1 openldap openldap2.3 - SSL certificate

Bulletin has no description...

Ubuntu USN-858-1 (openldap2.2)

The remote host is missing an update to openldap2.2 announced via advisory USN-858-1. OpenVAS Vulnerability Test $Id: ubuntu8581.nasl 7969 2017-12-01 09:23:16Z santu $ $Id: ubuntu8581.nasl 7969 2017-12-01 09:23:16Z santu $ Description: Auto-generated from advisory USN-858-1 openldap2.2 Authors:...

Ubuntu 6.06 LTS : openldap2.2 vulnerability (USN-858-1)

It was discovered that OpenLDAP did not correctly handle SSL certificates with zero bytes in the Common Name. A remote attacker could exploit this to perform a man in the middle attack to view sensitive information or alter encrypted communications. Note that Tenable Network Security has extracte...

[USN-858-1] OpenLDAP vulnerability

=========================================================== Ubuntu Security Notice USN-858-1 November 12, 2009 openldap2.2 vulnerability CVE-2009-3767 =========================================================== A security issue affects the following Ubuntu releases: Ubuntu 6.06 LTS This advisory...

OpenLDAP certificate spoofing

zero byte in common name is handled incorrectly...

USN-858-1: OpenLDAP vulnerability

It was discovered that OpenLDAP did not correctly handle SSL certificates with zero bytes in the Common Name. A remote attacker could exploit this to perform a machine-in-the-middle attack to view sensitive information or alter encrypted communications...

Mac OS X 10.6 < 10.6.2 Multiple Vulnerabilities

Binary data 800795.prm...

OpenLDAP 2.3.39 MODRDN Remote Denial of Service Vulnerability

No description provided by source. Attackers use readily available LDAP commands to exploit this issue. The following command demonstrates this issue: ldapmodrdn -x -h :389 -D dn -w pw -e \noop ou=test,dc=my-domain,dc=com ou=test2...

Mac OS X 10.6.x < 10.6.2 Multiple Vulnerabilities

The remote host is running a version of Mac OS X 10.6.x that is prior to 10.6.2. Mac OS X 10.6.2 contains security fixes for the following products : - Adaptive Firewall - Apache - Apache Portable Runtime - Certificate Assistant - CoreMedia - CUPS - Dovecot - fetchmail - file - FTP Server - Help...

OpenLDAP 2.3.39 - MODRDN Remote Denial of Service

Attackers use readily available LDAP commands to exploit this issue. source: https://www.securityfocus.com/bid/27778/info OpenLDAP is prone to a remote denial-of-service vulnerability. Attackers can exploit this issue to deny service to legitimate users. OpenLDAP 2.3.39 is vulnerable to this issu...

OpenLDAP 2.3.39 MODRDN Remote Denial of Service Vulnerability

Exploit for unknown platform in category dos / poc ============================================================= OpenLDAP 2.3.39 MODRDN Remote Denial of Service Vulnerability ============================================================= Title: OpenLDAP 2.3.39 MODRDN Remote Denial of Service...

OpenLDAP 2.3.39 - MODRDN Remote Denial of Service

OpenLDAP 2.3.39 - MODRDN Remote Denial of Service Attackers use readily available LDAP commands to exploit this issue. source: https://www.securityfocus.com/bid/27778/info OpenLDAP is prone to a remote denial-of-service vulnerability. Attackers can exploit this issue to deny service to legitimate...

OpenLDAP CA SSL证书验证漏洞

CVE ID: CVE-2009-3767 OpenLDAP是一款开放源代码的轻量级目录访问协议（LDAP）实现。 在使用OpenSSL的时候，OpenLDAP的libraries/libldap/tlso.c库没有正确地处理X.509证书主题通用名称（CN）字段域名中的空字符（\0），在处理包含有空字符的证书字段时错误地将空字符处理为截止字符，因此只会验证空字符前的部分。例如，对于类似于以下的名称： example.com\0.haxx.se 证书是发布给haxx.se的，但/tlso.c库错误的验证给example.com，这有助于攻击者通过中间人攻击执行网络钓鱼等欺骗。...

DEBIAN-CVE-2009-3767

libraries/libldap/tlso.c in OpenLDAP 2.2 and 2.4, and possibly other versions, when OpenSSL is used, does not properly handle a '\0' character in a domain name in the subject's Common Name CN field of an X.509 certificate, which allows man-in-the-middle attackers to spoof arbitrary SSL servers vi...

CVE-2009-3767

libraries/libldap/tlso.c in OpenLDAP 2.2 and 2.4, and possibly other versions, when OpenSSL is used, does not properly handle a '\0' character in a domain name in the subject's Common Name CN field of an X.509 certificate, which allows man-in-the-middle attackers to spoof arbitrary SSL servers vi...

CVE-2009-3767

libraries/libldap/tlso.c in OpenLDAP 2.2 and 2.4, and possibly other versions, when OpenSSL is used, does not properly handle a '\0' character in a domain name in the subject's Common Name CN field of an X.509 certificate, which allows man-in-the-middle attackers to spoof arbitrary SSL servers vi...

Design/Logic Flaw

libraries/libldap/tlso.c in OpenLDAP 2.2 and 2.4, and possibly other versions, when OpenSSL is used, does not properly handle a '\0' character in a domain name in the subject's Common Name CN field of an X.509 certificate, which allows man-in-the-middle attackers to spoof arbitrary SSL servers vi...

CVE-2009-3767

libraries/libldap/tlso.c in OpenLDAP 2.2 and 2.4, and possibly other versions, when OpenSSL is used, does not properly handle a '\0' character in a domain name in the subject's Common Name CN field of an X.509 certificate, which allows man-in-the-middle attackers to spoof arbitrary SSL servers vi...

CVE-2009-3767

CVE-2009-3767 affects OpenLDAP 2.4.x and related TLS implementations when OpenSSL is used, due to improper handling of a null character in the domain CN of an X.509 certificate, enabling MITM spoofing of SSL servers via a CA-issued certificate. Connected records indicate this CVE is tied to OpenL...