SB2012062901 - Buffer overflow in OpenLDAP
Published: June 29, 2012 Updated: July 28, 2020
Security Bulletin ID
SB2012062901
Severity
Low
Patch available
YES
Number of vulnerabilities
1
Exploitation vector
Remote access
Highest impact
Denial of service
Breakdown by Severity
- Low
- Medium
- High
- Critical
Description
This security bulletin contains information about 1 security vulnerability.
1) Buffer overflow (CVE-ID: CVE-2012-1164)
The vulnerability allows a remote non-authenticated attacker to perform service disruption.
slapd in OpenLDAP before 2.4.30 allows remote attackers to cause a denial of service (assertion failure and daemon exit) via an LDAP search query with attrsOnly set to true, which causes empty attributes to be returned.
Remediation
Install update from vendor's website.
References
- http://rhn.redhat.com/errata/RHSA-2012-0899.html
- http://seclists.org/fulldisclosure/2019/Dec/26
- http://secunia.com/advisories/48372
- http://secunia.com/advisories/49607
- http://security.gentoo.org/glsa/glsa-201406-36.xml
- http://www.mandriva.com/security/advisories?name=MDVSA-2012:130
- http://www.openldap.org/its/index.cgi/Software%20Bugs?id=7143
- http://www.openldap.org/software/release/changes.html
- http://www.securityfocus.com/bid/52404
- https://seclists.org/bugtraq/2019/Dec/23
- https://support.apple.com/kb/HT210788