Executive Summary

Informations
Name CVE-2012-2134 First vendor Publication 2014-02-26
Vendor Cve Last vendor Modification 2014-03-10

Security-Database Scoring CVSS v3

Cvss vector : N/A
Overall CVSS Score NA
Base Score NA Environmental Score NA
impact SubScore NA Temporal Score NA
Exploitabality Sub Score NA
 
Calculate full CVSS 3.0 Vectors scores

Security-Database Scoring CVSS v2

Cvss vector : (AV:N/AC:M/Au:N/C:N/I:N/A:P)
Cvss Base Score 4.3 Attack Range Network
Cvss Impact Score 2.9 Attack Complexity Medium
Cvss Expoit Score 8.6 Authentication None Required
Calculate full CVSS 2.0 Vectors scores

Detail

The handle_connection_error function in ldap_helper.c in bind-dyndb-ldap before 1.1.0rc1 does not properly handle LDAP query errors, which allows remote attackers to cause a denial of service (infinite loop and named server hang) via a non-alphabet character in the base DN in an LDAP search DNS query.

Original Source

Url : http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-2134

CWE : Common Weakness Enumeration

% Id Name
100 % CWE-399 Resource Management Errors

OVAL Definitions

Definition Id: oval:org.mitre.oval:def:21137
 
Oval ID: oval:org.mitre.oval:def:21137
Title: RHSA-2012:0683: bind-dyndb-ldap security update (Important)
Description: The handle_connection_error function in ldap_helper.c in bind-dyndb-ldap before 1.1.0rc1 does not properly handle LDAP query errors, which allows remote attackers to cause a denial of service (infinite loop and named server hang) via a non-alphabet character in the base DN in an LDAP search DNS query.
Family: unix Class: patch
Reference(s): RHSA-2012:0683-01
CESA-2012:0683
CVE-2012-2134
 Version: 5
Platform(s): Red Hat Enterprise Linux 6
CentOS Linux 6
 Product(s): bind-dyndb-ldap
Definition Synopsis:
Definition Id: oval:org.mitre.oval:def:23843
 
Oval ID: oval:org.mitre.oval:def:23843
Title: ELSA-2012:0683: bind-dyndb-ldap security update (Important)
Description: The handle_connection_error function in ldap_helper.c in bind-dyndb-ldap before 1.1.0rc1 does not properly handle LDAP query errors, which allows remote attackers to cause a denial of service (infinite loop and named server hang) via a non-alphabet character in the base DN in an LDAP search DNS query.
Family: unix Class: patch
Reference(s): ELSA-2012:0683-01
CVE-2012-2134
 Version: 6
Platform(s): Oracle Linux 6
 Product(s): bind-dyndb-ldap
Definition Synopsis:
Definition Id: oval:org.mitre.oval:def:27380
 
Oval ID: oval:org.mitre.oval:def:27380
Title: DEPRECATED: ELSA-2012-0683 -- bind-dyndb-ldap security update (important)
Description: [0.2.0-7.1] - fix for CVE-2012-2134
Family: unix Class: patch
Reference(s): ELSA-2012-0683
CVE-2012-2134
 Version: 4
Platform(s): Oracle Linux 6
 Product(s): bind-dyndb-ldap
Definition Synopsis:

CPE : Common Platform Enumeration

TypeDescriptionCount
Application 9

OpenVAS Exploits

Date Description
2012-10-23 Name : Fedora Update for bind-dyndb-ldap FEDORA-2012-15965
File : nvt/gb_fedora_2012_15965_bind-dyndb-ldap_fc17.nasl
2012-10-23 Name : Fedora Update for bind-dyndb-ldap FEDORA-2012-15981
File : nvt/gb_fedora_2012_15981_bind-dyndb-ldap_fc16.nasl
2012-08-30 Name : Fedora Update for bind-dyndb-ldap FEDORA-2012-11470
File : nvt/gb_fedora_2012_11470_bind-dyndb-ldap_fc17.nasl
2012-08-30 Name : Fedora Update for bind-dyndb-ldap FEDORA-2012-6666
File : nvt/gb_fedora_2012_6666_bind-dyndb-ldap_fc17.nasl
2012-08-21 Name : Fedora Update for bind-dyndb-ldap FEDORA-2012-11464
File : nvt/gb_fedora_2012_11464_bind-dyndb-ldap_fc16.nasl
2012-07-30 Name : CentOS Update for bind-dyndb-ldap CESA-2012:0683 centos6
File : nvt/gb_CESA-2012_0683_bind-dyndb-ldap_centos6.nasl
2012-07-09 Name : RedHat Update for bind-dyndb-ldap RHSA-2012:0683-01
File : nvt/gb_RHSA-2012_0683-01_bind-dyndb-ldap.nasl
2012-05-17 Name : Fedora Update for bind-dyndb-ldap FEDORA-2012-6722
File : nvt/gb_fedora_2012_6722_bind-dyndb-ldap_fc16.nasl
2012-05-17 Name : Fedora Update for bind-dyndb-ldap FEDORA-2012-6759
File : nvt/gb_fedora_2012_6759_bind-dyndb-ldap_fc15.nasl

Nessus® Vulnerability Scanner

Date Description
2013-07-12 Name : The remote Oracle Linux host is missing a security update.
File : oraclelinux_ELSA-2012-0683.nasl - Type : ACT_GATHER_INFO
2012-08-01 Name : The remote Scientific Linux host is missing one or more security updates.
File : sl_20120521_bind_dyndb_ldap_on_SL6_x.nasl - Type : ACT_GATHER_INFO
2012-05-29 Name : The remote Fedora host is missing a security update.
File : fedora_2012-6666.nasl - Type : ACT_GATHER_INFO
2012-05-23 Name : The remote CentOS host is missing a security update.
File : centos_RHSA-2012-0683.nasl - Type : ACT_GATHER_INFO
2012-05-22 Name : The remote Red Hat host is missing one or more security updates.
File : redhat-RHSA-2012-0683.nasl - Type : ACT_GATHER_INFO
2012-05-16 Name : The remote Fedora host is missing a security update.
File : fedora_2012-6722.nasl - Type : ACT_GATHER_INFO
2012-05-16 Name : The remote Fedora host is missing a security update.
File : fedora_2012-6759.nasl - Type : ACT_GATHER_INFO

Sources (Detail)

Source Url
CONFIRM https://bugzilla.redhat.com/show_bug.cgi?id=815846
https://git.fedorahosted.org/cgit/bind-dyndb-ldap.git/tree/NEWS
MLIST http://www.openwall.com/lists/oss-security/2012/04/24/15
https://www.redhat.com/archives/freeipa-users/2012-April/msg00144.html
OSVDB http://www.osvdb.org/81619
REDHAT http://rhn.redhat.com/errata/RHSA-2012-0683.html
SECUNIA http://secunia.com/advisories/48901

Alert History

If you want to see full details history, please login or register.
0
1
2
3
4
5
6
7
8
9
Date Informations
2021-05-05 01:10:25
  • Multiple Updates
2021-05-04 12:19:47
  • Multiple Updates
2021-04-22 01:23:28
  • Multiple Updates
2020-05-23 01:48:41
  • Multiple Updates
2020-05-23 00:33:31
  • Multiple Updates
2016-06-28 19:07:36
  • Multiple Updates
2016-04-26 21:46:31
  • Multiple Updates
2014-03-10 21:21:19
  • Multiple Updates
2014-02-27 21:21:27
  • Multiple Updates
2014-02-26 21:21:13
  • First insertion