Input validation error in openldap (Alpine package)

1) Input validation error

EUVDB-ID: #VU33285

Risk: Medium

CVSSv4.0: 2.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:U/U:Green]

CVE-ID: CVE-2015-6908

CWE-ID: CWE-20 - Improper input validation

Exploit availability: No

Description

The vulnerability allows a remote non-authenticated attacker to perform service disruption.

The ber_get_next function in libraries/liblber/io.c in OpenLDAP 2.4.42 and earlier allows remote attackers to cause a denial of service (reachable assertion and application crash) via crafted BER data, as demonstrated by an attack against slapd.

Mitigation

Install update from vendor's website.

Vulnerable software versions

openldap (Alpine package): 2.4.24-r0 - 2.4.35-r2

CPE2.3

• cpe:2.3:a:alpine:openldap_alpine_package:2.4.24-r0:*:*:*:*:alpine_linux:*:2.1
• cpe:2.3:a:alpine:openldap_alpine_package:2.4.24-r1:*:*:*:*:alpine_linux:*:2.1
• cpe:2.3:a:alpine:openldap_alpine_package:2.4.24-r2:*:*:*:*:alpine_linux:*:2.1

External links

https://git.alpinelinux.org/aports/commit/?id=9182b4452fd0f61c5cf3d6d43e31fc17ac2f9b1a
https://git.alpinelinux.org/aports/commit/?id=0c87e4a76b392a481552008dcdd888026a2e307c
https://git.alpinelinux.org/aports/commit/?id=155c547ee993aa64508638867875b2cbe79b1491
https://git.alpinelinux.org/aports/commit/?id=38f99bbb5423bbd53311287136f971848c5f831d
https://git.alpinelinux.org/aports/commit/?id=583a384a166961fb9dc95021c7f5f7b5d10e8910

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.