CVE-2012-0833

2012-07-0316:40:31

Debian Security Bug Tracker

security-tracker.debian.org

CVSS2

2.3

Attack Vector

ADJACENT_NETWORK

Attack Complexity

MEDIUM

Authentication

SINGLE

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

PARTIAL

AV:A/AC:M/Au:S/C:N/I:N/A:P

EPSS

0.002

Percentile

58.8%

JSON

The acllas__handle_group_entry function in servers/plugins/acl/acllas.c in 389 Directory Server before 1.2.10 does not properly handled access control instructions (ACIs) that use certificate groups, which allows remote authenticated LDAP users with a certificate group to cause a denial of service (infinite loop and CPU consumption) by binding to the server.

OSVersionArchitecturePackageVersionFilename
Debian12all389-ds-base< 2.3.1+dfsg1-1389-ds-base_2.3.1+dfsg1-1_all.deb
Debian11all389-ds-base< 1.4.4.11-2389-ds-base_1.4.4.11-2_all.deb
Debian999all389-ds-base< 3.1.1+dfsg1-1389-ds-base_3.1.1+dfsg1-1_all.deb
Debian13all389-ds-base< 3.1.1+dfsg1-1389-ds-base_3.1.1+dfsg1-1_all.deb

OS	Version	Architecture	Package	Version	Filename
Debian	12	all	389-ds-base	< 2.3.1+dfsg1-1	389-ds-base_2.3.1+dfsg1-1_all.deb
Debian	11	all	389-ds-base	< 1.4.4.11-2	389-ds-base_1.4.4.11-2_all.deb
Debian	999	all	389-ds-base	< 3.1.1+dfsg1-1	389-ds-base_3.1.1+dfsg1-1_all.deb
Debian	13	all	389-ds-base	< 3.1.1+dfsg1-1	389-ds-base_3.1.1+dfsg1-1_all.deb