blob: 5ca22245f8ebcc761760045af61963422204b891 [file] [log] [blame]
<?xml version="1.0" encoding="utf-8"?>
<glsa id="200808-09">
<title>OpenLDAP: Denial of Service vulnerability</title>
A flaw in OpenLDAP allows remote unauthenticated attackers to cause a
Denial of Service.
<product type="ebuild">openldap</product>
<announced>August 08, 2008</announced>
<revised>August 08, 2008: 01</revised>
<package name="net-nds/openldap" auto="yes" arch="*">
<unaffected range="ge">2.3.43</unaffected>
<vulnerable range="lt">2.3.43</vulnerable>
OpenLDAP Software is an open source implementation of the Lightweight
Directory Access Protocol.
Cameron Hotchkies discovered an error within the parsing of ASN.1 BER
encoded packets in the "ber_get_next()" function in
<impact type="low">
A remote unauthenticated attacker can send a specially crafted ASN.1
BER encoded packet which will trigger the error and cause an
"assert()", terminating the "slapd" daemon.
There is no known workaround at this time.
All OpenLDAP users should upgrade to the latest version:
# emerge --sync
# emerge --ask --oneshot --verbose &quot;&gt;=net-nds/openldap-2.3.43&quot;</code>
<uri link="">CVE-2008-2952</uri>
<metadata tag="submitter" timestamp="Tue, 05 Aug 2008 20:53:02 +0000">
<metadata tag="bugReady" timestamp="Tue, 05 Aug 2008 20:54:49 +0000">