Buffer overflow in openldap (Alpine package)
| Risk | Low |
| Patch available | YES |
| Number of vulnerabilities | 1 |
| CVE-ID | CVE-2012-1164 |
| CWE-ID | CWE-119 |
| Exploitation vector | Network |
| Public exploit | N/A |
| Vulnerable software Subscribe |
openldap (Alpine package) Operating systems & Components / Operating system package or component |
| Vendor | Alpine Linux Development Team |
Security Bulletin
This security bulletin contains one low risk vulnerability.
1) Buffer overflow
EUVDB-ID: #VU32774
Risk: Low
CVSSv3.1: 3.2 [CVSS:3.1/CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L/E:U/RL:O/RC:C]
CVE-ID: CVE-2012-1164
CWE-ID:
CWE-119 - Memory corruption
Exploit availability: No
DescriptionThe vulnerability allows a remote non-authenticated attacker to perform service disruption.
slapd in OpenLDAP before 2.4.30 allows remote attackers to cause a denial of service (assertion failure and daemon exit) via an LDAP search query with attrsOnly set to true, which causes empty attributes to be returned.
MitigationInstall update from vendor's website.
Vulnerable software versionsopenldap (Alpine package): 2.4.24-r0 - 2.4.24-r1
External linkshttp://git.alpinelinux.org/aports/commit/?id=a751b31bde3368f8b18be9b55a3445ffc0d191d3
http://git.alpinelinux.org/aports/commit/?id=2a4f6280e5cf666200003553bcb3240ef215c5ab
http://git.alpinelinux.org/aports/commit/?id=2216b84b681a71649cf6ac5ff6bde6ba8117541d
Q & A
Can this vulnerability be exploited remotely?
Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability.
