Microsoft活动目录服务内存泄漏漏洞(MS09-018)

BUGTRAQ ID: 35225 CVECAN ID: CVE-2009-1139 Microsoft Windows是微软发布的非常流行的操作系统。 LDAP服务在执行包含特定OID过滤器的LDAP或LDAPS请求时没有正确地管理内存。远程攻击者可以通过向Active Directory或ADAM服务器发送特制的LDAP或LDAPS报文触发内存破坏，导致受影响的系统停止接受请求。对于Windows 2000 Server，任何可以访问目标网络的匿名用户均可以向受影响的系统传递特制网络报文来利用此漏洞；在Server...

Microsoft活动目录服务LDAP报文内存破坏漏洞(MS09-018)

BUGTRAQ ID: 35226 CVECAN ID: CVE-2009-1138 Microsoft Windows是微软发布的非常流行的操作系统。 由于在处理特制LDAP或LDAPS请求时没有正确地释放内存，Windows 2000 Server上的Active Directory实现中存在一个远程执行代码漏洞。攻击者可能通过向运行Windows 2000 的域控制器发送特制的LDA 或LDAPS报文来利用该漏洞。任何可以访问目标网络的匿名用户均可以向受影响的系统传递特制报文以利用此漏洞。 Microsoft Windows 2000 Server SP4 临时解决方法：...

Microsoft Active Directory LDAP Remote Code Execution Vulnerability (969805)

This host is missing a critical security update according to Microsoft Bulletin MS09-018. SPDX-FileCopyrightText: 2009 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only...

Memory corruption

Memory leak in the LDAP service in Active Directory on Microsoft Windows 2000 SP4 and Server 2003 SP2, and Active Directory Application Mode ADAM on Windows XP SP2 and SP3 and Server 2003 SP2, allows remote attackers to cause a denial of service memory consumption and service outage via 1 LDAP or...

Design/Logic Flaw

The LDAP service in Active Directory on Microsoft Windows 2000 SP4 does not properly free memory for LDAP and LDAPS requests, which allows remote attackers to execute arbitrary code via a request that uses hexadecimal encoding, whose associated memory is not released, related to a "DN...

CVE-2009-1139

Memory leak in the LDAP service in Active Directory on Microsoft Windows 2000 SP4 and Server 2003 SP2, and Active Directory Application Mode ADAM on Windows XP SP2 and SP3 and Server 2003 SP2, allows remote attackers to cause a denial of service memory consumption and service outage via 1 LDAP or...

CVE-2009-1138

The LDAP service in Active Directory on Microsoft Windows 2000 SP4 does not properly free memory for LDAP and LDAPS requests, which allows remote attackers to execute arbitrary code via a request that uses hexadecimal encoding, whose associated memory is not released, related to a "DN...

CVE-2009-1138

CVE-2009-1138 concerns Microsoft Active Directory on Windows 2000 Server SP4, where the LDAP/LDAPS service fails to free memory for certain hex-encoded requests. The underlying issue, described as an invalid free/memory leak, can allow a remote attacker to cause arbitrary code execution on the ta...

CVE-2009-1139

CVE-2009-1139 is a memory leak/denial-of-service vulnerability in the LDAP service of Active Directory and ADAM. A remote attacker can trigger memory exhaustion by sending LDAP/LDAPS requests with specific OID filters. Affected: Windows 2000 Server SP4, Windows Server 2003 SP2, and ADAM on Window...

CVE-2009-1138

The LDAP service in Active Directory on Microsoft Windows 2000 SP4 does not properly free memory for LDAP and LDAPS requests, which allows remote attackers to execute arbitrary code via a request that uses hexadecimal encoding, whose associated memory is not released, related to a "DN...

CVE-2009-1139

Memory leak in the LDAP service in Active Directory on Microsoft Windows 2000 SP4 and Server 2003 SP2, and Active Directory Application Mode ADAM on Windows XP SP2 and SP3 and Server 2003 SP2, allows remote attackers to cause a denial of service memory consumption and service outage via 1 LDAP or...

MS09-018: Vulnerabilities in Active Directory Could Allow Remote Code Execution (971055)

The version of Microsoft Active Directory / Active Directory Application Mode installed on the remote host is affected by one or both of the following vulnerabilities : - A flaw involving the way memory is freed when handling specially crafted LDAP or LDAPS requests allows a remote attacker to...

Inside Patch Tuesday: MS patches IIS WebDav, PWN2OWN flaws

Microsoft released 10 security bulletins today. Six of the bulletins impact the Windows operating system, while one applies to the Internet Explorer browser and three affects Microsoft Office Word, Excel, Works. Some interesting notes for today: 1. Microsoft has patched the IIS WebDav 0-day. This...

Microsoft Active Directory LDAP Invalid Free Allocation (MS09-018; CVE-2009-1138)

Active Directory provides central authentication and authorization services for Windows-based systems. Active Directory Application Mode ADAM is a Lightweight Directory Access Protocol LDAP directory service that runs as a user service. A remote code execution vulnerability has been reported in...

Microsoft Security Bulletin MS09-018 - Critical Vulnerabilities in Active Directory Could Allow Remote Code Execution (971055)

Microsoft Security Bulletin MS09-018 - Critical Vulnerabilities in Active Directory Could Allow Remote Code Execution 971055 Published: June 9, 2009 Version: 1.0 General Information Executive Summary This security update resolves two privately reported vulnerabilities in implementations of Active...

Microsoft Active Directory Memory Leak Denial Of Service Vulnerability

Description Microsoft Active Directory is prone to a denial-of-service vulnerability. An attacker can exploit this issue to crash the server, denying access to legitimate users. Technologies Affected Avaya Messaging Application Server Avaya Messaging Application Server MM 1.1 Avaya Messaging...

Microsoft Active Directory Encoded LDAP String Memory Corruption Remote Code Execution Vulnerability

Description Microsoft Active Directory is prone to a remote code-execution vulnerability. Attackers can exploit this issue to execute arbitrary code in the context of the application. Successful exploits will completely compromise the affected computer. Failed attacks will cause denial-of-service...

RSA Panel Review – Macs in the Enterprise

Managing IT for a software company has its challenges. For me, the lines between efficiency, security and innovation are difficult to draw at a company like nCircle where engineers require some freedom to perform their best. The panelists at the RSA session “Responding to the ignored threat – Mac...

[NT] Microsoft Windows Active Directory LDAP Server Information Disclosure Vulnerability

The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com - - promotion The SecuriTeam alerts list - Free, Accurate, Independent. Get your security news from a reliable source...

CVE-2008-5112

The LDAP server in Active Directory in Microsoft Windows 2000 SP4 and Server 2003 SP1 and SP2 responds differently to a failed bind attempt depending on whether the user account exists and is permitted to login, which allows remote attackers to enumerate valid usernames via a series of LDAP bind...