Info

Disclosure

Jul 16, 2001

Discovery

Unknown

Dates

Exploit

Unknown

Solution

Unknown

Description

OpenLDAP contains a flaw that may allow a remote denial of service. The issue is triggered when an invalid length field in the Basic Encoding Rules (BER)is sent, and will result in loss of availability for the service.

Classification

Attack Type: Denial of Service
Impact: Loss of Availability

Solution

Upgrade to version 1.2.12 or 2.0.8 or higher, as it has been reported to fix this vulnerability. An upgrade is required as there are no known workarounds.

Products

OpenLDAP Foundation	OpenLDAP	1.0
		1.0.1
		1.0.2
		1.0.3
		1.1
		1.1.1
		1.1.2
		1.1.3
		1.1.4
		1.2
		1.2.1
		1.2.10
		1.2.11
		1.2.2
		1.2.3
		1.2.4
		1.2.5
		1.2.6
		1.2.7
		1.2.8
		1.2.9
		2.0
		2.0.1
		2.0.2
		2.0.3
		2.0.4
		2.0.5
		2.0.6
		2.0.7

References

CVE ID: 2001-0977 (see also: NVD)
Bugtraq ID: 3049
ISS X-Force ID: 6904
CERT VU: 935800
Vendor Specific Solution URL: http://distro.conectiva.com/atualizacoes/?id=a&anuncio=000417
Generic Informational URL: http://www.ee.oulu.fi/research/ouspg/protos/testing/c06/ldapv3/index.html
Vendor URL: http://www.openldap.org/
Other Advisory URL: http://www.securityfocus.com/advisories/3444
Vendor Specific Advisory URL: http://www.securityfocus.com/advisories/3485
http://www.securityfocus.com/advisories/3489
http://www.securityfocus.com/advisories/3498
http://www.securityfocus.com/advisories/3526

Credit

Unknown or Incomplete

Direct URL: http://osvdb.org/36218

Info

Disclosure

Discovery

Dates

Exploit

Solution

Description

Classification

Solution

Products

OpenLDAP Foundation

OpenLDAP

References

Credit