Lucene search

K
zdiOscar Mira-SanchezZDI-08-052
HistoryAug 14, 2008 - 12:00 a.m.

OpenLDAP BER Decoding Remote DoS Vulnerability

2008-08-1400:00:00
Oscar Mira-Sanchez
www.zerodayinitiative.com
8

5 Medium

CVSS2

Access Vector

NETWORK

Access Complexity

LOW

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

PARTIAL

AV:N/AC:L/Au:N/C:N/I:N/A:P

0.823 High

EPSS

Percentile

98.4%

This vulnerability allows remote attackers to deny services on vulnerable installations of OpenLDAP. Authentication is not required to exploit this vulnerability. The specific flaw exists in the decoding of ASN.1 BER network datagrams. When the size of a BerElement is specified incorrectly, the application will trigger an assert(), leading to abnormal program termination.

5 Medium

CVSS2

Access Vector

NETWORK

Access Complexity

LOW

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

PARTIAL

AV:N/AC:L/Au:N/C:N/I:N/A:P

0.823 High

EPSS

Percentile

98.4%