SB2022042617 - Denial of service in IBM Security Verify Password Synchronization Plug-in for Windows AD

Description

This security bulletin contains information about 2 vulnerabilities.

1) Heap-based buffer overflow (CVE-ID: CVE-2022-22323)

The vulnerability allows a remote user to perform a denial of service (DoS) attack.

The vulnerability exists due to a boundary error. A remote user can pass specially crafted data to the application, trigger heap-based buffer overflow and perform a denial of service (DoS) attack.

2) Heap-based buffer overflow (CVE-ID: CVE-2022-22312)

The vulnerability allows a remote user to perform a denial of service (DoS) attack.

The vulnerability exists due to a boundary error. A remote user can pass specially crafted data to the application, trigger heap-based buffer overflow and perform a denial of service (DoS) attack.

Remediation

Install update from vendor's website.

References

• https://www.ibm.com/blogs/psirt/security-bulletin-ibm-security-verify-password-synchronization-plug-in-for-windows-ad-is-vulnerable-to-a-denial-of-service-vulnerability-cve-2022-22323-cve-2022-22312/
• https://www.ibm.com/support/pages/node/6574671