Vulmon Recent Vulnerabilities Research Posts Trends Blog About Contact
5
CVSSv2

CVE-2008-2952

Published: 01/07/2008 Updated: 07/11/2023
CVSS v2 Base Score: 5 | Impact Score: 2.9 | Exploitability Score: 10
VMScore: 505
Vector: AV:N/AC:L/Au:N/C:N/I:N/A:P
Subscribe to Openldap

Vulnerability Summary

liblber/io.c in OpenLDAP 2.2.4 to 2.4.10 allows remote malicious users to cause a denial of service (program termination) via crafted ASN.1 BER datagrams that trigger an assertion error.

Vulnerable Product Search on Vulmon Subscribe to Product

openldap openldap 2.3.5

openldap openldap 2.2.4

openldap openldap 2.3.31

openldap openldap 2.3.42

openldap openldap 2.3.32

openldap openldap 2.3.41

openldap openldap 2.3.17

openldap openldap 2.3.12

openldap openldap 2.2.9

openldap openldap 2.3.8

openldap openldap 2.3.27

openldap openldap 2.3.36

openldap openldap 2.3.39

openldap openldap 2.3.43

openldap openldap 2.3.20

openldap openldap 2.3.40

openldap openldap 2.3.13

openldap openldap 2.3.38

openldap openldap 2.3.14

openldap openldap 2.2.7

openldap openldap 2.3.10

openldap openldap 2.3.26

openldap openldap 2.3.6

openldap openldap 2.3.30

openldap openldap 2.2.5

openldap openldap 2.3.18

openldap openldap 2.2.6

openldap openldap 2.3.9

openldap openldap 2.3.7

openldap openldap 2.3.24

openldap openldap 2.3.21

openldap openldap 2.3.15

openldap openldap 2.3.33

openldap openldap 2.3.29

openldap openldap 2.3.25

openldap openldap 2.3.19

openldap openldap 2.3.35

openldap openldap 2.3.28

openldap openldap 2.3.11

openldap openldap 2.2.8

openldap openldap 2.3.37

openldap openldap 2.3.23

openldap openldap 2.4.10

openldap openldap 2.3.16

openldap openldap 2.3.22

openldap openldap 2.3.34

openldap openldap 2.3.4

Vendor Advisories

Debian CVElist Bug Report Logs: slapd: CVE-2008-2952 remote denial of service
Debian Bug report logs - #488710 slapd: CVE-2008-2952 remote denial of service Package: slapd; Maintainer for slapd is Debian OpenLDAP Maintainers <pkg-openldap-devel@listsaliothdebianorg>; Source for slapd is src:openldap (PTS, buildd, popcon) Reported by: Steffen Joeris <steffenjoeris@skolelinuxde> Date: Mon, ...
Ubuntu Security Notice: openldap2.2, openldap2.3 vulnerability
Cameron Hotchkies discovered that OpenLDAP did not correctly handle certain ASN1 BER data A remote attacker could send a specially crafted packet and crash slapd, leading to a denial of service ...
Debian Security Advisories: DSA-1650-1 openldap2.3 -- denial of service
Cameron Hotchkies discovered that the OpenLDAP server slapd, a free implementation of the Lightweight Directory Access Protocol, could be crashed by sending malformed ASN1 requests For the stable distribution (etch), this problem has been fixed in version 2330-5+etch2 For the unstable distribution (sid), this problem has been fixed in version 2 ...

Exploits

Exploit DB: OpenLDAP 2.3.41 - BER Decoding Remote Denial of Service
source: wwwsecurityfocuscom/bid/30013/info OpenLDAP is prone to a remote denial-of-service vulnerability Attackers can exploit this issue to deny service to legitimate users by crashing affected servers OpenLDAP 2341 is vulnerable to this issue; earlier versions back to approximately 2118 as well as newer versions may also be affe ...

References

CWE-399http://secunia.com/advisories/30853http://www.securitytracker.com/id?1020405http://www.openldap.org/its/index.cgi/Software%20Bugs?id=5580http://lists.apple.com/archives/security-announce//2008/Jul/msg00003.htmlhttp://www.ubuntu.com/usn/usn-634-1http://www.openwall.com/lists/oss-security/2008/07/01/2http://www.securityfocus.com/bid/30013http://secunia.com/advisories/31364http://security.gentoo.org/glsa/glsa-200808-09.xmlhttps://www.redhat.com/archives/fedora-package-announce/2008-July/msg00129.htmlhttp://secunia.com/advisories/31326https://www.redhat.com/archives/fedora-package-announce/2008-July/msg00109.htmlhttp://www.mandriva.com/security/advisories?name=MDVSA-2008:144http://www.openwall.com/lists/oss-security/2008/07/13/2http://secunia.com/advisories/31436http://secunia.com/advisories/30917http://www.redhat.com/support/errata/RHSA-2008-0583.htmlhttp://wiki.rpath.com/Advisories:rPSA-2008-0249https://issues.rpath.com/browse/RPL-2645http://www.debian.org/security/2008/dsa-1650http://secunia.com/advisories/32254http://lists.opensuse.org/opensuse-security-announce/2008-10/msg00006.htmlhttp://secunia.com/advisories/32316http://secunia.com/advisories/30996http://www.zerodayinitiative.com/advisories/ZDI-08-052/http://www.vupen.com/english/advisories/2008/1978/referenceshttp://www.vupen.com/english/advisories/2008/2268https://exchange.xforce.ibmcloud.com/vulnerabilities/43515https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10662http://www.securityfocus.com/archive/1/495320/100/0/threadedhttp://www.openldap.org/its/index.cgi/Software%20Bugs?id=5580%3Bselectid=5580https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=488710https://usn.ubuntu.com/634-1/https://nvd.nist.govhttps://www.exploit-db.com/exploits/32000/
VMScore
CVSSv2
CVSSv3
VMScore
Recommendations:
CVE-2024-27322CVE-2006-4304wirelessCVE-2023-23022local file inclusionCVE-2024-27058CVE-2024-33820open redirectCVE-2024-27079
Vulnerability Notification Service
You don’t have to wait for vulnerability scanning results
Get Started

Vulmon Search

Vulmon Search is a vulnerability search engine. It gives comprehensive vulnerability information through a very simple user interface.

About

Home Recent Vulnerabilities Research Posts Trends Blog About Contact

Products

Vulmon Search Vulmon Research Vulmon Alerts Vulmap

Connect

Twitter Reddit Linkedin Facebook