CVE-2008-2952

Public PoC / Exploit (2)

TrickestTrickest PoC index Exploit-DBOpenLDAP 2.3.41 - BER Decoding Remote Denial of Service

Links to public security research (Exploit-DB, Nuclei, Trickest, GitHub) for defensive use only.

Description

liblber/io.c in OpenLDAP 2.2.4 to 2.4.10 allows remote attackers to cause a denial of service (program termination) via crafted ASN.1 BER datagrams that trigger an assertion error.

Weaknesses (CWE)

CWE-399

Affected Products (47)

openldap · openldapvulnerable

References (20)

http://lists.apple.com/archives/security-announce//2008/Jul/msg00003.html

http://lists.opensuse.org/opensuse-security-announce/2008-10/msg00006.html

http://secunia.com/advisories/30853

Vendor Advisory

http://secunia.com/advisories/30917

Vendor Advisory

http://secunia.com/advisories/30996

Vendor Advisory

http://secunia.com/advisories/31326

Vendor Advisory

http://secunia.com/advisories/31364

Vendor Advisory

http://secunia.com/advisories/31436

Vendor Advisory

http://secunia.com/advisories/32254

Vendor Advisory

http://secunia.com/advisories/32316

Vendor Advisory

http://security.gentoo.org/glsa/glsa-200808-09.xml

http://wiki.rpath.com/Advisories:rPSA-2008-0249

http://www.debian.org/security/2008/dsa-1650

http://www.mandriva.com/security/advisories?name=MDVSA-2008:144

http://www.openldap.org/its/index.cgi/Software%20Bugs?id=5580

http://www.openldap.org/its/index.cgi/Software%20Bugs?id=5580%3Bselectid=5580

http://www.openwall.com/lists/oss-security/2008/07/01/2

http://www.openwall.com/lists/oss-security/2008/07/13/2

http://www.redhat.com/support/errata/RHSA-2008-0583.html

http://www.securityfocus.com/archive/1/495320/100/0/threaded