Red Hat 389-ds-base stack buffer overflow vulnerability

Red Hat 389-ds-base is an American Red Hat package that includes a Linux directory server and a server administration command-line program. A stack buffer overflow vulnerability exists in Red Hat 389-ds-base versions 1.3.6.x prior to 1.3.6.13, 1.3.7.x prior to 1.3.7.9, and 1.4.x prior to 1.4.0.5....

CentOS Update for 389-ds-base CESA-2018:0163 centos7

Check the version of 389-ds-base SPDX-FileCopyrightText: 2018 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription scriptoid"1.3.6.1.4.1.25623.1.0.882838";...

389-ds-base: Remote DoS via search filters in slapi_filter_sprintf in slapd/util.c

A stack buffer overflow flaw was found in the way 389-ds-base handled certain LDAP search filters. A remote, unauthenticated attacker could potentially use this flaw to make ns-slapd crash via a specially crafted LDAP request, thus resulting in denial of service...

XRootD LDAP Code Execution

The vulnerability of the XRootD file server is related to the lack of measures to sanitize input data when processing LDAP requests. Exploiting this vulnerability allows a remote attacker to execute arbitrary code...

Debian DSA-4046-1 : libspring-ldap-java - security update

Tobias Schneider discovered that libspring-ldap-java, a Java library for Spring-based applications using the Lightweight Directory Access Protocol, would under some circumstances allow authentication with a correct username but an arbitrary password. %NASLMINLEVEL 70300 C Tenable Network Security...

[SECURITY] [DSA 4046-1] libspring-ldap-java security update

------------------------------------------------------------------------- Debian Security Advisory DSA-4046-1 [email protected] https://www.debian.org/security/ Sebastien Delafond November 22, 2017 https://www.debian.org/security/faq -...

CVE-2017-4927

VMware vCenter Server 6.5 prior to 6.5 U1 and 6.0 prior to 6.0 U3c does not correctly handle specially crafted LDAP network packets which may allow for remote denial of service...

USN-3457-1 curl vulnerability

Brian Carpenter discovered that curl incorrectly handled IMAP FETCH response lines. A remote attacker could use this issue to cause curl to crash, resulting in a denial of service, or possibly execute arbitrary code...

UBUNTU-CVE-2017-1000257

An IMAP FETCH response line indicates the size of the returned data, in number of bytes. When that response says the data is zero bytes, libcurl would pass on that non-existing data with a pointer and the size zero to the deliver-data function. libcurl's deliver-data function treats zero as a mag...

LDAP Injection Vulnerability in Joomla!

Joomla! is the United States Open Source Matters team developed a set of open source content management system CMS. Joomla! 3.7.5 and previous versions of the system in the case of open LDAP authentication injection vulnerability, the vulnerability stems from the LDAP validation used ldapsearch...

DEBIAN-CVE-2017-14623

In the ldap.v2 aka go-ldap package through 2.5.0 for Go, an attacker may be able to login with an empty password. This issue affects an application using this package if these conditions are met: 1 it relies only on the return error of the Bind function call to determine whether a user is...

OpenJDK: LDAPCertStore following referrals to non-LDAP URLs (Security, 8176067)

It was discovered that the LDAPCertStore class in the Security component of OpenJDK followed LDAP referrals to arbitrary URLs. A specially crafted LDAP referral URL could cause LDAPCertStore to communicate with non-LDAP servers...

[SECURITY] Fedora 26 Update: cyrus-imapd-3.0.3-1.fc26

The Cyrus IMAP Internet Message Access Protocol server provides access to personal mail, system-wide bulletin boards, news-feeds, calendar and contac ts through the IMAP, JMAP, NNTP, CalDAV and CardDAV protocols. The Cyrus IMAP server is a scalable enterprise groupware system designed for use fro...

Cisco Adaptive Security Appliance Web Interface Credential Disclosure

The vulnerability of the web interface of Cisco Adaptive Security Appliance microprogramming software is related to the lack of protection for service data during interactions with the SSL Connection Profile using the LDAP protocol. Exploiting this vulnerability can allow a malicious actor to...

OpenJDK: LDAPCertStore following referrals to non-LDAP URLs (Security, 8176067)

It was discovered that the LDAPCertStore class in the Security component of OpenJDK followed LDAP referrals to arbitrary URLs. A specially crafted LDAP referral URL could cause LDAPCertStore to communicate with non-LDAP servers...

Cisco Adaptive Security Appliance Information Disclosure Vulnerability (CNVD-2017-20382)

The Cisco Adaptive Security Appliance is a set of firewall appliances from the American company Cisco. A security vulnerability exists in the Cisco Adaptive Security Appliance when configured with both Lightweight Directory Access Protocol LDAP and SSL Connection Profile, which allows remote...

PT-2017-2627 · Cisco · Cisco Asa

Name of the Vulnerable Software and Affected Versions: Cisco Adaptive Security Appliance versions 9.33 through 9.62 Description: The issue is related to a lack of protection for service data when interacting with the SSL Connection Profile via the LDAP protocol in the web interface of the Cisco...

Moderate: Red Hat Security Advisory: openldap security, bug fix, and enhancement update

An update for openldap is now available for Red Hat Enterprise Linux 7. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from t...

CVE-2017-8919

NetApp OnCommand API Services before 1.2P3 logs the LDAP BIND password when a user attempts to log in using the REST API, which allows remote authenticated users to obtain sensitive password information via unspecified vectors...

CVE-2017-11501

NixOS 17.03 and earlier has an unintended default absence of SSL Certificate Validation for LDAP. The users.ldap NixOS module implements user authentication against LDAP servers via a PAM module. It was found that if TLS is enabled to connect to the LDAP server with users.ldap.useTLS, peer...