CVE-2015-7540

The LDAP server in the AD domain controller in Samba 4.x before 4.1.22 does not check return values to ensure successful ASN.1 memory allocation, which allows remote attackers to cause a denial of service memory consumption and daemon crash via crafted packets...

Denial of service in Samba Active Directory

Description All versions of Samba from 4.0.0 to 4.3.2 inclusive resp. all ldb versions up to 1.1.23 inclusive are vulnerable to a denial of service attack in the samba daemon LDAP server. A malicious client can send packets that cause the LDAP server in the samba daemon process to become...

Security fix for the ALT Linux 7 package samba version 4.3.3-alt1

Dec. 16, 2015 Andrey Cherepanov 4.3.3-alt1 - New version https://www.samba.org/samba/history/samba-4.3.3.html - Security fixes: - CVE-2015-3223 Denial of service in Samba Active Directory server - CVE-2015-5252 Insufficient symlink verification in smbd - CVE-2015-5299 Missing access control check...

Security fix for the ALT Linux 10 package samba version 4.3.3-alt1

Dec. 16, 2015 Andrey Cherepanov 4.3.3-alt1 - New version https://www.samba.org/samba/history/samba-4.3.3.html - Security fixes: - CVE-2015-3223 Denial of service in Samba Active Directory server - CVE-2015-5252 Insufficient symlink verification in smbd - CVE-2015-5299 Missing access control check...

VMware vCenter Server updates address a LDAP certificate validation issue

VMware vCenter Server LDAP certificate validation vulnerability. VMware vCenter Server does not validate the certificate when connecting to a single sign on identity source using LDAPS LDAP over SSL. This applies when connecting to Active Directory as an LDAP Server or OpenLDAP. Exploitation of...

KLA10665 Obtain sensitive information vulnerability in VMware vCenter Server

Improper certificate validation was found in VMware vCenter Server. By exploiting this vulnerability malicious users can obtain sensitive information. This vulnerability can be exploited remotely via a traffic interception. Technical details This vulnerability can be exploited when vCenter Server...

Moderate: Red Hat Bug Fix Advisory: 389-ds-base bug fix update

Updated 389-ds-base packages that fix several bugs are now available for Red Hat Enterprise Linux 7. The 389 Directory Server is an LDAPv3 compliant server. The base packages include the LDAP server and command-line utilities for server administration. This update fixes the following bugs:...

Authentication flaw

The REST API in F5 BIG-IQ Cloud, Device, and Security 4.4.0 and 4.5.0 before HF2 and ADC 4.5.0 before HF2, when configured for LDAP remote authentication and the LDAP server allows anonymous BIND operations, allows remote attackers to obtain an authentication token for arbitrary users by guessing...

CVE-2015-4637

The REST API in F5 BIG-IQ Cloud, Device, and Security 4.4.0 and 4.5.0 before HF2 and ADC 4.5.0 before HF2, when configured for LDAP remote authentication and the LDAP server allows anonymous BIND operations, allows remote attackers to obtain an authentication token for arbitrary users by guessing...

MGASA-2015-0143 Updated openldap packages fix CVE-2015-1545

Updated openldap packages fix security vulnerability: The deref overlay in slapd 2.4.13 through 2.4.40 dereferences a NULL pointer when a search request includes the Deref control with an empty list of attributes to return missing input validation. This allows a remote unauthenticated client to...

CVE-2015-0117

The CVE-2015-0117 issue affects IBM Domino LDAP Server. A stack buffer overflow arises from insufficient validation when processing a crafted LDAP ModifyRequest, copying data into a fixed-length stack buffer. This allows a remote, unauthenticated attacker to cause memory corruption and potentiall...

RedHat Update for 389-ds-base RHSA-2015:0416-01

The remote host is missing an update for the SPDX-FileCopyrightText: 2015 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Important: Red Hat Security Advisory: 389-ds-base security, bug fix, and enhancement update

Updated 389-ds-base packages that fix one security issue, two bugs, and add one enhancement are now available for Red Hat Enterprise Linux 6. Red Hat Product Security has rated this update as having Important security impact. A Common Vulnerability Scoring System CVSS base score, which gives a...

ldapsearch notes

I seem to find open LDAP servers on the Internet more often than I should. Here are some notes on using ldapsearch Installing ldapsearch on Ubuntu 1 | apt-get install ldap-utils ---|--- Root-DSE object nmap includes a script to gather info from a LDAP root-dse object . We can also use ldapsearch ...

Gnupg2 'dirmngr/ldapserver.c' Double Free Denial of Service Vulnerability

GnuPG is a Python module that allows, from a Python program, to conveniently use the key management, encryption and signing features of GnuPG. A denial of service vulnerability exists in Gnupg2 'dirmngr/ldapserver.c', which can be exploited by an attacker to launch a denial of service attack...

CentOS 6 : 389-ds-base (CESA-2013:1752)

Updated 389-ds-base packages that fix one security issue are now available for Red Hat Enterprise Linux 6. The Red Hat Security Response Team has rated this update as having important security impact. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, i...

CVE-2014-0074

Apache Shiro 1.x before 1.2.3, when using an LDAP server with unauthenticated bind enabled, allows remote attackers to bypass authentication via an empty 1 username or 2 password...

CVE-2014-0074

Apache Shiro 1.x before 1.2.3, when using an LDAP server with unauthenticated bind enabled, allows remote attackers to bypass authentication via an empty 1 username or 2 password...

CommuniGate Systems CommuniGate Pro LDAP Server Buffer Overflow

There exists a buffer overflow vulnerability in CommuniGate Systems CommuniGate Pro LDAP server. The flaw is caused by improper validation of the user supplied LDAP message. An attacker may exploit this vulnerability to cause a denial of service condition of the affected server...

CentOS Update for 389-ds-base CESA-2014:1031 centos7

The remote host is missing an update for the SPDX-FileCopyrightText: 2014 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...