RHEL 6 : 389-ds-base (RHSA-2014:0292)

The remote Redhat Enterprise Linux 6 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2014:0292 advisory. The 389 Directory Server is an LDAPv3 compliant server. The base packages include the Lightweight Directory Access Protocol LDAP server and...

389 security update

CentOS Errata and Security Advisory CESA-2014:0292 Updated 389-ds-base packages that fix one security issue are now available for Red Hat Enterprise Linux 6. The Red Hat Security Response Team has rated this update as having Important security impact. A Common Vulnerability Scoring System CVSS ba...

Citrix NetScaler应用交付控制器跨站LDAP注入漏洞(CVE-2013-6943)

BUGTRAQ ID: 66043 CVECAN ID: CVE-2013-6943 Citrix NetScaler是一款网络流量管理产品。 Citrix NetScaler SDX 10.0及9.3版本的应用支付控制器在实现上存在安全漏洞，攻击者可利用此漏洞造成SSH和Web管理用户名内的LDAP注入。 0 Citrix NetScaler SDX 9.x Citrix NetScaler SDX 10.x 厂商补丁： Citrix ------ Citrix已经为此发布了一个安全公告（CTX139049）以及相应补丁: CTX139049：Citrix NetScaler...

CVE-2013-6943

Citrix NetScaler Application Delivery Controller ADC 9.3.x before 9.3-64.4, 10.0 before 10.0-77.5, and 10.1 before 10.1-118.7 allows remote attackers to conduct an LDAP injection attack via vectors related to SSH and Web management usernames...

Code injection

Citrix NetScaler Application Delivery Controller ADC 9.3.x before 9.3-64.4, 10.0 before 10.0-77.5, and 10.1 before 10.1-118.7 allows remote attackers to conduct an LDAP injection attack via vectors related to SSH and Web management usernames...

[SECURITY] Fedora 19 Update: openldap-2.4.39-2.fc19

OpenLDAP is an open source suite of LDAP Lightweight Directory Access Protocol applications and development tools. LDAP is a set of protocols for accessing directory services usually phone book style information, but other information is possible over the Internet, similar to the way DNS Domain...

CVE-2013-4496: Password lockout not enforced for SAMR password changes

Description Samba versions 3.4.0 and above allow the administrator to implement locking out Samba accounts after a number of bad password attempts. However, all released versions of Samba did not implement this check for password changes, such as are available over multiple SAMR and RAP interface...

CVE-2013-6943

Citrix NetScaler Application Delivery Controller ADC 9.3.x before 9.3-64.4, 10.0 before 10.0-77.5, and 10.1 before 10.1-118.7 allows remote attackers to conduct an LDAP injection attack via vectors related to SSH and Web management usernames...

CVE-2013-6943

Citrix NetScaler ADC is affected by LDAP injection (CVE-2013-6943) in the management paths. Affects ADC 9.3.x before 9.3-64.4, 10.0 before 10.0-77.5, and 10.1 before 10.1-118.7. The vulnerability allows remote attackers to inject LDAP queries via SSH and Web management usernames. Remediation is a...

Fedora 20 : php-5.5.10-1.fc20 (2014-3534)

Excerpt from upstream NEWS: 06 Mar 2014, PHP 5.5.10 Core : - Fixed Request 66574i Allow multiple paths in phpiniscannedpath. Remi Date : - Fixed bug 45528 Allow the DateTimeZone constructor to accept timezones per offset too. Derick Fileinfo : - Fixed bug 66731 file: infinite recursion...

Palo Alto Networks PAN-OS < 4.0.9 / 4.1.x < 4.1.3 Information Disclosure

The remote host is running a version of Palo Alto Networks PAN-OS prior to 4.0.9 / 4.1.3. It is, therefore, affected by an information disclosure vulnerability due to LDAP bind passwords being logged in plaintext when using default logging settings. Note that the 3.1 branch is not affected by thi...

Zabbix < 1.8.20 / 2.0.11 / 2.2.2 Multiple Vulnerabilities

According to its self-reported version number, the instance of Zabbix listening on the remote host is potentially affected by the following vulnerabilities : - An error exists related to LDAP authentication that could disclose the LDAP bind password. CVE-2013-5572 - An error exists related to HTT...

[Responder] a LLMNR and NBT-NS poisoner, with built-in HTTP/SMB/MSSQL/FTP/LDAP rogue authentication server

Responder is a LLMNR and NBT-NS poisoner, with built-in HTTP/SMB/MSSQL/FTP/LDAP rogue authentication server supporting NTLMv1/NTLMv2/LMv2, Extended Security NTLMSSP and Basic HTTP authentication. This tool is first an LLMNR and NBT-NS responder, it will answer to specific NBT-NS NetBIOS Name...

[Directory Scanner v3.0] Remote Directory Server Fingerprinting Tool

Directory Scanner is the FREE Directory Server fingerprinting tool. It can help you to remotely detect the type of Directory servers such as Microsoft Active Directory, Novell eDirectory etc running on the local network as well as Internet. In addition to this, it can greatly help administrators ...

CVE-2012-2134

The handleconnectionerror function in ldaphelper.c in bind-dyndb-ldap before 1.1.0rc1 does not properly handle LDAP query errors, which allows remote attackers to cause a denial of service infinite loop and named server hang via a non-alphabet character in the base DN in an LDAP search DNS query...

Design/Logic Flaw

The handleconnectionerror function in ldaphelper.c in bind-dyndb-ldap before 1.1.0rc1 does not properly handle LDAP query errors, which allows remote attackers to cause a denial of service infinite loop and named server hang via a non-alphabet character in the base DN in an LDAP search DNS query...

CVE-2012-2134

CVE-2012-2134 affects bind-dyndb-ldap (LDAP back-end plug-in) in MiracleLinux 4 and similar builds. The vulnerability arises from improper handling of LDAP query errors in handle_connection_error, which can cause an infinite loop and hang of the named server when a non-alphabet character appears ...

CVE-2012-2134

The handleconnectionerror function in ldaphelper.c in bind-dyndb-ldap before 1.1.0rc1 does not properly handle LDAP query errors, which allows remote attackers to cause a denial of service infinite loop and named server hang via a non-alphabet character in the base DN in an LDAP search DNS query...

CVE-2012-2134

Removed by vendor...

MGASA-2014-0095 Updated zabbix packages fix multiple vulnerabilities

Updated zabbix packages fix security vulnerabilities: Zabbix before 2.0.11 allows remote authenticated users to discover the LDAP bind password by leveraging management-console access and reading the ldapbindpassword value in the HTML source code CVE-2013-5572. Zabbix before 2.0.11 allows switchi...