liblber/io.c in OpenLDAP 2.2.4 to 2.4.10 allows remote attackers to cause a denial of service (program termination) via crafted ASN.1 BER d…

Exploit prediction (EPSS)

13.17% probability of exploitation in the next 30 days, higher than 96% of all scored CVEs.

Exploits and detections

• EDB-32000 OpenLDAP 2.3.41 - BER Decoding Remote Denial of Service · dos · 2008-06-30

CVSS scores

Classification

Weakness

• CWE-399 Resource Management Errors

References

• redhat.com /support/errata/RHSA-2008-0583.html · vendor-advisory, x_refsource_REDHAT, x_transferred
• security.gentoo.org /glsa/glsa-200808-09.xml · vendor-advisory, x_refsource_GENTOO, x_transferred
• secunia.com /advisories/31364 · third-party-advisory, x_refsource_SECUNIA, x_transferred
• oval.cisecurity.org /repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10662 · vdb-entry, signature, x_refsource_OVAL, x_transferred
• secunia.com /advisories/30917 · third-party-advisory, x_refsource_SECUNIA, x_transferred
• lists.apple.com /archives/security-announce//2008/Jul/msg00003.html · vendor-advisory, x_refsource_APPLE, x_transferred
• exchange.xforce.ibmcloud.com /vulnerabilities/43515 · vdb-entry, x_refsource_XF, x_transferred
• openldap.org /its/index.cgi/Software%20Bugs?id=5580%3Bselectid=5580 · x_refsource_CONFIRM, x_transferred
• debian.org /security/2008/dsa-1650 · vendor-advisory, x_refsource_DEBIAN, x_transferred
• securityfocus.com /bid/30013 · vdb-entry, x_refsource_BID, x_transferred
• openwall.com /lists/oss-security/2008/07/01/2 · mailing-list, x_refsource_MLIST, x_transferred
• vupen.com /english/advisories/2008/2268 · vdb-entry, x_refsource_VUPEN, x_transferred
• securityfocus.com /archive/1/495320/100/0/threaded · mailing-list, x_refsource_BUGTRAQ, x_transferred
• issues.rpath.com /browse/RPL-2645 · x_refsource_CONFIRM, x_transferred
• secunia.com /advisories/30996 · third-party-advisory, x_refsource_SECUNIA, x_transferred
• secunia.com /advisories/31436 · third-party-advisory, x_refsource_SECUNIA, x_transferred
• lists.opensuse.org /opensuse-security-announce/2008-10/msg00006.html · vendor-advisory, x_refsource_SUSE, x_transferred
• mandriva.com /security/advisories?name=MDVSA-2008:144 · vendor-advisory, x_refsource_MANDRIVA, x_transferred
• openwall.com /lists/oss-security/2008/07/13/2 · mailing-list, x_refsource_MLIST, x_transferred
• ubuntu.com /usn/usn-634-1 · vendor-advisory, x_refsource_UBUNTU, x_transferred
• zerodayinitiative.com /advisories/ZDI-08-052/ · x_refsource_MISC, x_transferred
• secunia.com /advisories/30853 · third-party-advisory, x_refsource_SECUNIA, x_transferred
• wiki.rpath.com /Advisories:rPSA-2008-0249 · x_refsource_CONFIRM, x_transferred
• secunia.com /advisories/31326 · third-party-advisory, x_refsource_SECUNIA, x_transferred
• redhat.com /archives/fedora-package-announce/2008-July/msg00129.html · vendor-advisory, x_refsource_FEDORA, x_transferred
• secunia.com /advisories/32254 · third-party-advisory, x_refsource_SECUNIA, x_transferred
• securitytracker.com /id?1020405 · vdb-entry, x_refsource_SECTRACK, x_transferred
• vupen.com /english/advisories/2008/1978/references · vdb-entry, x_refsource_VUPEN, x_transferred
• openldap.org /its/index.cgi/Software%20Bugs?id=5580 · x_refsource_CONFIRM, x_transferred
• redhat.com /archives/fedora-package-announce/2008-July/msg00109.html · vendor-advisory, x_refsource_FEDORA, x_transferred
• secunia.com /advisories/32316 · third-party-advisory, x_refsource_SECUNIA, x_transferred

Sources

• CVE List: CVE-2008-2952
• NVD: CVE-2008-2952

vulnwire keeps one entry per vulnerability: the CVE id wins, then GHSA; records that alias each other are merged. Machine-readable: JSON.