CVE-2012-2134

2014-02-2615:55:08

CWE-399

[email protected]

web.nvd.nist.gov

cve-2012-2134

bind-dyndb-ldap

ldap

denial of service

security vulnerability

4.3 Medium

CVSS2

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

PARTIAL

AV:N/AC:M/Au:N/C:N/I:N/A:P

6.2 Medium

AI Score

Confidence

Low

0.012 Low

EPSS

Percentile

85.5%

JSON

The handle_connection_error function in ldap_helper.c in bind-dyndb-ldap before 1.1.0rc1 does not properly handle LDAP query errors, which allows remote attackers to cause a denial of service (infinite loop and named server hang) via a non-alphabet character in the base DN in an LDAP search DNS query.

Affected configurations

NVD

Node

martin_nagybind-dyndb-ldapRange≤1.1.0b2

martin_nagybind-dyndb-ldapMatch0.1.0a1

martin_nagybind-dyndb-ldapMatch0.1.0b

martin_nagybind-dyndb-ldapMatch0.2.0

martin_nagybind-dyndb-ldapMatch1.0.0b1

martin_nagybind-dyndb-ldapMatch1.0.0rc1

martin_nagybind-dyndb-ldapMatch1.1.0a1

martin_nagybind-dyndb-ldapMatch1.1.0a2

martin_nagybind-dyndb-ldapMatch1.1.0b1

CPENameOperatorVersion
martin_nagy:bind-dyndb-ldapmartin nagy bind-dyndb-ldaple1.1.0
martin_nagy:bind-dyndb-ldapmartin nagy bind-dyndb-ldapeq0.1.0
martin_nagy:bind-dyndb-ldapmartin nagy bind-dyndb-ldapeq0.2.0
martin_nagy:bind-dyndb-ldapmartin nagy bind-dyndb-ldapeq1.0.0

CPE	Name	Operator	Version
martin_nagy:bind-dyndb-ldap	martin nagy bind-dyndb-ldap	le	1.1.0
martin_nagy:bind-dyndb-ldap	martin nagy bind-dyndb-ldap	eq	0.1.0
martin_nagy:bind-dyndb-ldap	martin nagy bind-dyndb-ldap	eq	0.2.0
martin_nagy:bind-dyndb-ldap	martin nagy bind-dyndb-ldap	eq	1.0.0