CVSS2
Attack Vector
NETWORK
Attack Complexity
LOW
Authentication
NONE
Confidentiality Impact
COMPLETE
Integrity Impact
COMPLETE
Availability Impact
COMPLETE
AV:N/AC:L/Au:N/C:C/I:C/A:C
EPSS
Percentile
95.1%
A buffer overflow in some implementations of the LDAP protocol may allow a remote unauthenticated attacker to execute arbitrary code.
The Lightweight Directory Access Protocol (LDAP) is a protocol for accessing network based directories. A lack of bounds checking in some implementations of the LDAP protocol may allow a buffer used to generate error messages to overflow. If a remote unauthenticated attacker supplies a LDAP server with a specially crafted request, they may be able to trigger the buffer overflow to compromise the vulnerable server.
A remote unauthenticated attacker may be able to execute arbitrary code on a vulnerable LDAP server with the privileges of the compromised LDAP process, or crash the LDAP process resulting in a denial-of-service condition.
Users who suspect they are vulnerable are encouraged to check with their vendor to determine the appropriate action to take.
Limit Access
Block or restrict access to the LDAP service (389/tcp or 636/tcp) on affected systems from untrusted networks such as the Internet. Sites, particularly those who are not able to apply the appropriate patches, are encouraged to consider implementing this workaround. Note that this change may break some desired functionality depending on particular site configuration details. As a general rule and a matter of good security practice, the CERT/CC recommends blocking access to all services that are not explicitly required.
258905
Filter by status: All Affected Not Affected Unknown
Filter by content: __ Additional information available
__ Sort by: Status Alphabetical
Expand all
Javascript is disabled. Click here to view vendors.
Notified: December 09, 2004 Updated: January 11, 2005
Affected
HP has released a Security Bulletin to address this issue. For further information, please refer to the following URL:
<http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=PSD_HPSBUX01105>
The vendor has not provided us with any further information regarding this vulnerability.
US-CERT has no additional comments at this time.
If you have feedback, comments, or additional information about this vulnerability, please send us [email](<mailto:[email protected]?Subject=VU%23258905 Feedback>).
Notified: December 10, 2004 Updated: January 13, 2005
Affected
Hitachi Directory Server Version 2 is vulnerable to this issue.
More details are available at
<http://www.hitachi-support.com/security_e/vuls_e/HS05-001_e/index-e.html>
The vendor has not provided us with any further information regarding this vulnerability.
US-CERT has no additional comments at this time.
If you have feedback, comments, or additional information about this vulnerability, please send us [email](<mailto:[email protected]?Subject=VU%23258905 Feedback>).
Updated: January 11, 2005
Affected
We have not received a statement from the vendor.
The vendor has not provided us with any further information regarding this vulnerability.
A statement provided by Red Hat concerning Netscape Directory Server version 6.21 and earlier can be found at the following URL:
<https://www.kb.cert.org/vulcatalog/id/SSTT-67PTDF>
If you have feedback, comments, or additional information about this vulnerability, please send us [email](<mailto:[email protected]?Subject=VU%23258905 Feedback>).
Notified: December 09, 2004 Updated: January 10, 2005
Affected
Vendor Statement: Red Hat, Inc:
Netscape Directory Server version 6.21 and earlier are vulnerable to this issue. In December 2004 Red Hat aquired the Netscape Directory Server product from America Online, Inc. Patches are available by contacting the Red Hat Security Response Team by email at [email protected]. More details are available at
<http://rhn.redhat.com/errata/RHSA-2005-030.html>
The vendor has not provided us with any further information regarding this vulnerability.
US-CERT has no additional comments at this time.
If you have feedback, comments, or additional information about this vulnerability, please send us [email](<mailto:[email protected]?Subject=VU%23258905 Feedback>).
Notified: December 09, 2004 Updated: January 14, 2005
Not Affected
Mac OS X v10.2.x and Mac OS X Server v10.2.x or earlier are not affected by this issue as they do not contain the vulnerable versions of the LDAP server.
Mac OS X v10.3.x and Mac OS X Server v10.3.x are not affected by this issue in their supported configurations.
The vendor has not provided us with any further information regarding this vulnerability.
US-CERT has no additional comments at this time.
If you have feedback, comments, or additional information about this vulnerability, please send us [email](<mailto:[email protected]?Subject=VU%23258905 Feedback>).
Notified: December 10, 2004 Updated: January 13, 2005
Not Affected
We have not received a statement from the vendor.
The vendor has not provided us with any further information regarding this vulnerability.
US-CERT has no additional comments at this time.
If you have feedback, comments, or additional information about this vulnerability, please send us [email](<mailto:[email protected]?Subject=VU%23258905 Feedback>).
Notified: December 09, 2004 Updated: January 11, 2005
Not Affected
Juniper Networks products are not susceptible to this vulnerability.
The vendor has not provided us with any further information regarding this vulnerability.
US-CERT has no additional comments at this time.
If you have feedback, comments, or additional information about this vulnerability, please send us [email](<mailto:[email protected]?Subject=VU%23258905 Feedback>).
Notified: December 09, 2004 Updated: December 16, 2004
Not Affected
The IBM Lotus Domino server is not vulnerable to this LDAP issue.
The vendor has not provided us with any further information regarding this vulnerability.
US-CERT has no additional comments at this time.
If you have feedback, comments, or additional information about this vulnerability, please send us [email](<mailto:[email protected]?Subject=VU%23258905 Feedback>).
Notified: December 10, 2004 Updated: January 13, 2005
Not Affected
Related information is published on _<http://www.sw.nec.co.jp/psirt/bnin2005.html#1>_
The vendor has not provided us with any further information regarding this vulnerability.
US-CERT has no additional comments at this time.
If you have feedback, comments, or additional information about this vulnerability, please send us [email](<mailto:[email protected]?Subject=VU%23258905 Feedback>).
Notified: December 09, 2004 Updated: January 11, 2005
Not Affected
The OpenLDAP Project has evaluated
* OpenLDAP Software 2.2.17 (current "stable" version) and
* OpenLDAP Software 2.2.19 (current "release" version)
as well as development and release engineering sources, as distributed by the OpenLDAP Project. We found that long attribute names in LDAP request PDUs do not cause a buffer overflow, nor even lead to unexpected behavior (regardless of whether the long attribute name is defined or not in the subschema).
The OpenLDAP Project did not evaluate older versions of OpenLDAP Software. As these versions are no longer maintained by the OpenLDAP Project, the OpenLDAP Project recommends (irregardless of this issue) that users of these versions consider upgrading to a current version.
The OpenLDAP Project also did not evaluate any 3rd party software, including software based upon (in any fashion) OpenLDAP Software.
The vendor has not provided us with any further information regarding this vulnerability.
US-CERT has no additional comments at this time.
If you have feedback, comments, or additional information about this vulnerability, please send us [email](<mailto:[email protected]?Subject=VU%23258905 Feedback>).
Notified: December 10, 2004 Updated: January 13, 2005
Not Affected
We have not received a statement from the vendor.
The vendor has not provided us with any further information regarding this vulnerability.
US-CERT has no additional comments at this time.
If you have feedback, comments, or additional information about this vulnerability, please send us [email](<mailto:[email protected]?Subject=VU%23258905 Feedback>).
Notified: December 09, 2004 Updated: January 11, 2005
Not Affected
We have not received a statement from the vendor.
The vendor has not provided us with any further information regarding this vulnerability.
US-CERT has no additional comments at this time.
If you have feedback, comments, or additional information about this vulnerability, please send us [email](<mailto:[email protected]?Subject=VU%23258905 Feedback>).
Notified: December 09, 2004 Updated: December 15, 2004
Unknown
We have not received a statement from the vendor.
The vendor has not provided us with any further information regarding this vulnerability.
US-CERT has no additional comments at this time.
If you have feedback, comments, or additional information about this vulnerability, please send us [email](<mailto:[email protected]?Subject=VU%23258905 Feedback>).
Notified: December 09, 2004 Updated: December 15, 2004
Unknown
We have not received a statement from the vendor.
The vendor has not provided us with any further information regarding this vulnerability.
US-CERT has no additional comments at this time.
If you have feedback, comments, or additional information about this vulnerability, please send us [email](<mailto:[email protected]?Subject=VU%23258905 Feedback>).
Notified: December 09, 2004 Updated: December 15, 2004
Unknown
We have not received a statement from the vendor.
The vendor has not provided us with any further information regarding this vulnerability.
US-CERT has no additional comments at this time.
If you have feedback, comments, or additional information about this vulnerability, please send us [email](<mailto:[email protected]?Subject=VU%23258905 Feedback>).
Notified: December 09, 2004 Updated: December 15, 2004
Unknown
We have not received a statement from the vendor.
The vendor has not provided us with any further information regarding this vulnerability.
US-CERT has no additional comments at this time.
If you have feedback, comments, or additional information about this vulnerability, please send us [email](<mailto:[email protected]?Subject=VU%23258905 Feedback>).
Notified: December 09, 2004 Updated: December 15, 2004
Unknown
We have not received a statement from the vendor.
The vendor has not provided us with any further information regarding this vulnerability.
US-CERT has no additional comments at this time.
If you have feedback, comments, or additional information about this vulnerability, please send us [email](<mailto:[email protected]?Subject=VU%23258905 Feedback>).
Notified: December 09, 2004 Updated: December 15, 2004
Unknown
We have not received a statement from the vendor.
The vendor has not provided us with any further information regarding this vulnerability.
US-CERT has no additional comments at this time.
If you have feedback, comments, or additional information about this vulnerability, please send us [email](<mailto:[email protected]?Subject=VU%23258905 Feedback>).
Notified: December 09, 2004 Updated: December 16, 2004
Unknown
We have not received a statement from the vendor.
The vendor has not provided us with any further information regarding this vulnerability.
US-CERT has no additional comments at this time.
If you have feedback, comments, or additional information about this vulnerability, please send us [email](<mailto:[email protected]?Subject=VU%23258905 Feedback>).
Notified: December 10, 2004 Updated: January 13, 2005
Unknown
Related information will be published on <http://software.fujitsu.com/jp/security/vuls/vuls.html#1BF8D7AA_ldap>
The vendor has not provided us with any further information regarding this vulnerability.
US-CERT has no additional comments at this time.
If you have feedback, comments, or additional information about this vulnerability, please send us [email](<mailto:[email protected]?Subject=VU%23258905 Feedback>).
Notified: December 09, 2004 Updated: December 15, 2004
Unknown
We have not received a statement from the vendor.
The vendor has not provided us with any further information regarding this vulnerability.
US-CERT has no additional comments at this time.
If you have feedback, comments, or additional information about this vulnerability, please send us [email](<mailto:[email protected]?Subject=VU%23258905 Feedback>).
Notified: December 09, 2004 Updated: December 15, 2004
Unknown
We have not received a statement from the vendor.
The vendor has not provided us with any further information regarding this vulnerability.
US-CERT has no additional comments at this time.
If you have feedback, comments, or additional information about this vulnerability, please send us [email](<mailto:[email protected]?Subject=VU%23258905 Feedback>).
Notified: December 09, 2004 Updated: December 15, 2004
Unknown
We have not received a statement from the vendor.
The vendor has not provided us with any further information regarding this vulnerability.
US-CERT has no additional comments at this time.
If you have feedback, comments, or additional information about this vulnerability, please send us [email](<mailto:[email protected]?Subject=VU%23258905 Feedback>).
Notified: December 09, 2004 Updated: December 15, 2004
Unknown
We have not received a statement from the vendor.
The vendor has not provided us with any further information regarding this vulnerability.
US-CERT has no additional comments at this time.
If you have feedback, comments, or additional information about this vulnerability, please send us [email](<mailto:[email protected]?Subject=VU%23258905 Feedback>).
Notified: December 09, 2004 Updated: January 05, 2005
Unknown
We have not received a statement from the vendor.
The vendor has not provided us with any further information regarding this vulnerability.
US-CERT has no additional comments at this time.
If you have feedback, comments, or additional information about this vulnerability, please send us [email](<mailto:[email protected]?Subject=VU%23258905 Feedback>).
Notified: December 09, 2004 Updated: December 15, 2004
Unknown
We have not received a statement from the vendor.
The vendor has not provided us with any further information regarding this vulnerability.
US-CERT has no additional comments at this time.
If you have feedback, comments, or additional information about this vulnerability, please send us [email](<mailto:[email protected]?Subject=VU%23258905 Feedback>).
Notified: December 09, 2004 Updated: December 16, 2004
Unknown
We have not received a statement from the vendor.
The vendor has not provided us with any further information regarding this vulnerability.
US-CERT has no additional comments at this time.
If you have feedback, comments, or additional information about this vulnerability, please send us [email](<mailto:[email protected]?Subject=VU%23258905 Feedback>).
Notified: December 09, 2004 Updated: December 16, 2004
Unknown
We have not received a statement from the vendor.
The vendor has not provided us with any further information regarding this vulnerability.
US-CERT has no additional comments at this time.
If you have feedback, comments, or additional information about this vulnerability, please send us [email](<mailto:[email protected]?Subject=VU%23258905 Feedback>).
Notified: December 14, 2004 Updated: December 15, 2004
Unknown
We have not received a statement from the vendor.
The vendor has not provided us with any further information regarding this vulnerability.
US-CERT has no additional comments at this time.
If you have feedback, comments, or additional information about this vulnerability, please send us [email](<mailto:[email protected]?Subject=VU%23258905 Feedback>).
Notified: December 09, 2004 Updated: December 15, 2004
Unknown
We have not received a statement from the vendor.
The vendor has not provided us with any further information regarding this vulnerability.
US-CERT has no additional comments at this time.
If you have feedback, comments, or additional information about this vulnerability, please send us [email](<mailto:[email protected]?Subject=VU%23258905 Feedback>).
Notified: December 09, 2004 Updated: December 15, 2004
Unknown
We have not received a statement from the vendor.
The vendor has not provided us with any further information regarding this vulnerability.
US-CERT has no additional comments at this time.
If you have feedback, comments, or additional information about this vulnerability, please send us [email](<mailto:[email protected]?Subject=VU%23258905 Feedback>).
Notified: December 09, 2004 Updated: December 15, 2004
Unknown
We have not received a statement from the vendor.
The vendor has not provided us with any further information regarding this vulnerability.
US-CERT has no additional comments at this time.
If you have feedback, comments, or additional information about this vulnerability, please send us [email](<mailto:[email protected]?Subject=VU%23258905 Feedback>).
Notified: December 14, 2004 Updated: December 17, 2004
Unknown
We have not received a statement from the vendor.
The vendor has not provided us with any further information regarding this vulnerability.
US-CERT has no additional comments at this time.
If you have feedback, comments, or additional information about this vulnerability, please send us [email](<mailto:[email protected]?Subject=VU%23258905 Feedback>).
Notified: December 14, 2004 Updated: December 17, 2004
Unknown
We have not received a statement from the vendor.
The vendor has not provided us with any further information regarding this vulnerability.
US-CERT has no additional comments at this time.
If you have feedback, comments, or additional information about this vulnerability, please send us [email](<mailto:[email protected]?Subject=VU%23258905 Feedback>).
Notified: December 09, 2004 Updated: December 15, 2004
Unknown
We have not received a statement from the vendor.
The vendor has not provided us with any further information regarding this vulnerability.
US-CERT has no additional comments at this time.
If you have feedback, comments, or additional information about this vulnerability, please send us [email](<mailto:[email protected]?Subject=VU%23258905 Feedback>).
Notified: December 09, 2004 Updated: December 15, 2004
Unknown
We have not received a statement from the vendor.
The vendor has not provided us with any further information regarding this vulnerability.
US-CERT has no additional comments at this time.
If you have feedback, comments, or additional information about this vulnerability, please send us [email](<mailto:[email protected]?Subject=VU%23258905 Feedback>).
Notified: December 09, 2004 Updated: December 15, 2004
Unknown
We have not received a statement from the vendor.
The vendor has not provided us with any further information regarding this vulnerability.
US-CERT has no additional comments at this time.
If you have feedback, comments, or additional information about this vulnerability, please send us [email](<mailto:[email protected]?Subject=VU%23258905 Feedback>).
Notified: December 14, 2004 Updated: December 17, 2004
Unknown
We have not received a statement from the vendor.
The vendor has not provided us with any further information regarding this vulnerability.
US-CERT has no additional comments at this time.
If you have feedback, comments, or additional information about this vulnerability, please send us [email](<mailto:[email protected]?Subject=VU%23258905 Feedback>).
Notified: December 10, 2004 Updated: January 13, 2005
Unknown
We have not received a statement from the vendor.
The vendor has not provided us with any further information regarding this vulnerability.
US-CERT has no additional comments at this time.
If you have feedback, comments, or additional information about this vulnerability, please send us [email](<mailto:[email protected]?Subject=VU%23258905 Feedback>).
Notified: December 09, 2004 Updated: December 15, 2004
Unknown
We have not received a statement from the vendor.
The vendor has not provided us with any further information regarding this vulnerability.
US-CERT has no additional comments at this time.
If you have feedback, comments, or additional information about this vulnerability, please send us [email](<mailto:[email protected]?Subject=VU%23258905 Feedback>).
Notified: December 09, 2004 Updated: December 15, 2004
Unknown
We have not received a statement from the vendor.
The vendor has not provided us with any further information regarding this vulnerability.
US-CERT has no additional comments at this time.
If you have feedback, comments, or additional information about this vulnerability, please send us [email](<mailto:[email protected]?Subject=VU%23258905 Feedback>).
View all 41 vendors __View less vendors __
Group | Score | Vector |
---|---|---|
Base | ||
Temporal | ||
Environmental |
Thanks to HIRT (Hitachi Incident Response Team).
This document was written by Damon Morda, Stacey Stewart and Jeffrey Gennari.
CVE IDs: | CVE-2004-1236 |
---|---|
Severity Metric: | 7.88 Date Public: |