CVE-2014-8182 - An off-by-one error leading to a crash was discovered in openldap 2.4 when processing DNS SRV messag

CVE-2014-8182

Summary

An off-by-one error leading to a crash was discovered in openldap 2.4 when processing DNS SRV messages. If slapd was configured to use the dnssrv backend, an attacker could crash the service with crafted DNS responses.

References

Vulnerable Configurations

cpe:2.3:a:openldap:openldap:2.4:*:*:*:*:*:*:*
cpe:2.3:a:openldap:openldap:2.4:*:*:*:*:*:*:*
cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:*
cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:*
cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:*
cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:*
cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:*
cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:*

CVSS

Base:	4.3 (as of 09-01-2020 - 16:39)
Impact:
Exploitability:

CWE

CWE-193

CAPEC

Access

Vector	Complexity	Authentication
NETWORK	MEDIUM	NONE

Impact

Confidentiality	Integrity	Availability
NONE	NONE	PARTIAL

cvss-vector via4

AV:N/AC:M/Au:N/C:N/I:N/A:P

redhat via4

advisories

bugzilla

id	1202696
title	ppc64: slaptest segfault in openldap-2.4.40

oval

comment Red Hat Enterprise Linux must be installed
oval oval:com.redhat.rhba:tst:20070304026

AND

comment Red Hat Enterprise Linux 6 is installed
oval oval:com.redhat.rhba:tst:20111656003

AND
comment openldap is earlier than 0:2.4.40-5.el6
oval oval:com.redhat.rhba:tst:20151292001
comment openldap is signed with Red Hat redhatrelease2 key
oval oval:com.redhat.rhba:tst:20151292002

AND

comment openldap-clients is earlier than 0:2.4.40-5.el6
oval oval:com.redhat.rhba:tst:20151292003
comment openldap-clients is signed with Red Hat redhatrelease2 key
oval oval:com.redhat.rhba:tst:20151292004

AND

comment openldap-devel is earlier than 0:2.4.40-5.el6
oval oval:com.redhat.rhba:tst:20151292005
comment openldap-devel is signed with Red Hat redhatrelease2 key
oval oval:com.redhat.rhba:tst:20151292006

AND

comment openldap-servers is earlier than 0:2.4.40-5.el6
oval oval:com.redhat.rhba:tst:20151292007
comment openldap-servers is signed with Red Hat redhatrelease2 key
oval oval:com.redhat.rhba:tst:20151292008

AND

comment openldap-servers-sql is earlier than 0:2.4.40-5.el6
oval oval:com.redhat.rhba:tst:20151292009
comment openldap-servers-sql is signed with Red Hat redhatrelease2 key
oval oval:com.redhat.rhba:tst:20151292010

rhsa

id	RHBA-2015:1292
released	2015-07-22
severity	Low
title	RHBA-2015:1292: openldap bug fix and enhancement update (Low)

rpms

openldap-0:2.4.40-5.el6
openldap-clients-0:2.4.40-5.el6
openldap-debuginfo-0:2.4.40-5.el6
openldap-devel-0:2.4.40-5.el6
openldap-servers-0:2.4.40-5.el6
openldap-servers-sql-0:2.4.40-5.el6
openldap-0:2.4.40-8.el7
openldap-clients-0:2.4.40-8.el7
openldap-debuginfo-0:2.4.40-8.el7
openldap-devel-0:2.4.40-8.el7
openldap-servers-0:2.4.40-8.el7
openldap-servers-sql-0:2.4.40-8.el7

refmap via4

misc

Last major update

09-01-2020 - 16:39

Published

02-01-2020 - 23:15

Last modified

09-01-2020 - 16:39