FrSIRT - OpenLDAP Data Processing Multiple Denial of Service Vulnerabilities / Exploit (Security Advisories)

French Security Incident Response Team

French

English

OpenLDAP Data Processing Multiple Denial of Service Vulnerabilities

Title : OpenLDAP Data Processing Multiple Denial of Service Vulnerabilities
Advisory ID : FrSIRT/ADV-2007-3645
CVE ID : CVE-2007-5707 - CVE-2007-5708 - CVE-2007-6698
Rated as : Moderate Risk

Remotely Exploitable : Yes
Locally Exploitable : Yes
Release Date : 2007-10-29

Advisory Details

Description

Affected Products

Solution

References

Technical Description

Multiple vulnerabilities have been identified in OpenLDAP, which could be exploited by attackers to cause a denial of service [...]

Solution

Upgrade to OpenLDAP version 2.3.39 :
http://www.openldap.org/software/download/

Credits

Vulnerabilities reported by the vendor, Toby Blake and Thomas Sesselmann.

ChangeLog

2007-10-29 : Initial release
2008-02-08 : Updated Description

Vulnerability Management

Subscribe to FrSIRT VNS and receive real-time e-mail and SMS alerts when new vulnerabilities, exploits, or patches relevant to your systems and network configurations are available.

Feedback

If you have additional information or corrections for this security advisory please submit them via our contact form or by email to updates@frsirt.com.

Mailinglist

	IBM WebSphere Application Server Security Exposure Vulnerabilities
	IBM AIX DNS Transaction ID Remote Cache Poisoning Vulnerability
	IBM Tivoli Directory Server Entry Handling Double-Free Vulnerability
	IBM AFP Viewer Plug-In "SRC" Property Buffer Overflow Vulnerability
	IBM Hardware Management Console Cross Site Scripting Vulnerabilities
	IBM OS/400 BrSmRcvAndCheck Local Buffer Overflow Vulnerability
	IBM DB2 Multiple Buffer Overflow and Security Bypass Vulnerabilities

	Sun Solaris System Management Agent Buffer Overflow Vulnerability
	Sun Update Fixes Mozilla Thunderbird Multiple Vulnerabilities
	Sun Java JDK and JRE Code Execution and Security Bypass Issues
	Sun Solaris DNS Protocol Remote Cache Poisoning Vulnerability
	Sun Solaris Tomcat JSP/Servlet Container Multiple Vulnerabilities
	Sun Java System Access Manager XSLT Code Execution Vulnerability
	Sun Solaris 10 Adobe Reader Multiple Code Execution Vulnerabilities

	Microsoft Office Word Document Handling Code Execution Vulnerability
	Microsoft SQL Server Privilege Escalation Vulnerabilities (MS08-040)
	Microsoft Exchange Server Cross Site Scripting Issues (MS08-039)
	Microsoft Windows Explorer Remote Code Execution (MS08-038)
	Microsoft Windows Multiple DNS Spoofing Vulnerabilities (MS08-037)
	Microsoft Access Snapshot Viewer ActiveX Control Vulnerability
	Microsoft Internet Explorer Frame Cross-Domain Scripting Vulnerability