Published: 05/02/2014 Updated: 08/12/2016

CVSS v2 Base Score: 4.3 | Impact Score: 2.9 | Exploitability Score: 8.6

VMScore: 383

Vector: AV:N/AC:M/Au:N/C:N/I:N/A:P

The rwm overlay in OpenLDAP 2.4.23, 2.4.36, and previous versions does not properly count references, which allows remote malicious users to cause a denial of service (slapd crash) by unbinding immediately after a search request, which triggers rwm_conn_destroy to free the session context while it is being used by rwm_op_search.

Vulnerable Product	Search on Vulmon	Subscribe to Product
debian debian linux 7.0
debian debian linux 8.0
openldap openldap 2.4.16
openldap openldap 2.4.15
openldap openldap 2.4.29
openldap openldap 2.4.28
openldap openldap 2.4.20
openldap openldap 2.4.19
openldap openldap
openldap openldap 2.4.6
openldap openldap 2.4.7
openldap openldap 2.4.14
openldap openldap 2.4.13
openldap openldap 2.4.27
openldap openldap 2.4.26
openldap openldap 2.4.35
openldap openldap 2.4.34
openldap openldap 2.4.18
openldap openldap 2.4.17
openldap openldap 2.4.10
openldap openldap 2.4.30
openldap openldap 2.4.22
openldap openldap 2.4.21
openldap openldap 2.4.31
openldap openldap 2.4.23
openldap openldap 2.4.8
openldap openldap 2.4.9
openldap openldap 2.4.12
openldap openldap 2.4.11
openldap openldap 2.4.25
openldap openldap 2.4.24
openldap openldap 2.4.33
openldap openldap 2.4.32

Synopsis Moderate: openldap security and bug fix update Type/Severity Security Advisory: Moderate Topic Updated openldap packages that fix one security issue and one bug are nowavailable for Red Hat Enterprise Linux 6The Red Hat Security Response Team has rated this update as having moderatesecurity impact ...

OpenLDAP could be made to crash if it received specially crafted network traffic ...

Multiple vulnerabilities were found in OpenLDAP, a free implementation of the Lightweight Directory Access Protocol CVE-2013-4449 Michael Vishchers from Seven Principles AG discovered a denial of service vulnerability in slapd, the directory server implementation When the server is configured to used the RWM overlay, an attacker ...

Debian Bug report logs - #729367 openldap: CVE-2013-4449 Package: openldap; Maintainer for openldap is Debian OpenLDAP Maintainers <pkg-openldap-devel@listsaliothdebianorg>; Reported by: Moritz Muehlenhoff <jmm@inutilorg> Date: Tue, 12 Nov 2013 12:06:02 UTC Severity: important Tags: patch, security Found in vers ...

Debian Bug report logs - #776988 openldap: CVE-2015-1545: crashes on search with deref control and empty attr list Package: slapd; Maintainer for slapd is Debian OpenLDAP Maintainers <pkg-openldap-devel@listsaliothdebianorg>; Source for slapd is src:openldap (PTS, buildd, popcon) Reported by: Ryan Tandy <ryan@nardisca ...

Debian Bug report logs - #761406 slapd: CVE-2014-9713: dangerous access rule in default config Package: slapd; Maintainer for slapd is Debian OpenLDAP Maintainers <pkg-openldap-devel@listsaliothdebianorg>; Source for slapd is src:openldap (PTS, buildd, popcon) Reported by: Dietrich Clauss <dietrich@clauss-itcom> ...

The rwm overlay in OpenLDAP 2423, 2436, and earlier does not properly count references, which allows remote attackers to cause a denial of service (slapd crash) by unbinding immediately after a search request, which triggers rwm_conn_destroy to free the session context while it is being used by rwm_op_search ...

Full Disclosure mailing list archives   By Date By Thread </form>    APPLE-SA-2019-12-10-3 macOS Catalina 10152, Security Update 2019-002 Mojave, Security Update 2019-007 High Sierra <! ...

CWE-189 http://www.securitytracker.com/id/1029711 http://www.openldap.org/its/index.cgi/Incoming?id=7723 https://bugzilla.redhat.com/show_bug.cgi?id=1019490 http://www.openwall.com/lists/oss-security/2013/10/19/3 http://rhn.redhat.com/errata/RHSA-2014-0126.html http://www.securityfocus.com/bid/63190 http://rhn.redhat.com/errata/RHSA-2014-0206.html http://www.mandriva.com/security/advisories?name=MDVSA-2014:026 http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2013-4449 http://www.debian.org/security/2015/dsa-3209 http://www.oracle.com/technetwork/topics/security/ovmbulletinjul2016-3090546.html http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10735 http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10705 https://support.apple.com/kb/HT210788 https://seclists.org/bugtraq/2019/Dec/23 http://seclists.org/fulldisclosure/2019/Dec/26 https://access.redhat.com/errata/RHSA-2014:0126 https://usn.ubuntu.com/2622-1/https://nvd.nist.gov https://access.redhat.com/security/cve/cve-2013-4449

CVE-2013-4449

Vulnerability Summary

Vulnerability Trend

Vendor Advisories

Mailing Lists

References

Vulmon Search

About

Products

Connect