Executive Summary
| Informations | |||
|---|---|---|---|
| Name | CVE-2008-2952 | First vendor Publication | 2008-07-01 |
| Vendor | Cve | Last vendor Modification | 2024-11-21 |
Security-Database Scoring CVSS v3
| Cvss vector : N/A | |||
|---|---|---|---|
| Overall CVSS Score | NA | ||
| Base Score | NA | Environmental Score | NA |
| impact SubScore | NA | Temporal Score | NA |
| Exploitabality Sub Score | NA | ||
| Calculate full CVSS 3.0 Vectors scores | |||
Security-Database Scoring CVSS v2
| Cvss vector : (AV:N/AC:L/Au:N/C:N/I:N/A:P) | |||
|---|---|---|---|
| Cvss Base Score | 5 | Attack Range | Network |
| Cvss Impact Score | 2.9 | Attack Complexity | Low |
| Cvss Expoit Score | 10 | Authentication | None Required |
| Calculate full CVSS 2.0 Vectors scores | |||
Detail
| liblber/io.c in OpenLDAP 2.2.4 to 2.4.10 allows remote attackers to cause a denial of service (program termination) via crafted ASN.1 BER datagrams that trigger an assertion error. |
Original Source
| Url : http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-2952 |
CWE : Common Weakness Enumeration
| % | Id | Name |
|---|---|---|
| 100 % | CWE-399 | Resource Management Errors |
OVAL Definitions
| Definition Id: oval:org.mitre.oval:def:10662 | |||
| Oval ID: | oval:org.mitre.oval:def:10662 | ||
| Title: | liblber/io.c in OpenLDAP 2.2.4 to 2.4.10 allows remote attackers to cause a denial of service (program termination) via crafted ASN.1 BER datagrams that trigger an assertion error. | ||
| Description: | liblber/io.c in OpenLDAP 2.2.4 to 2.4.10 allows remote attackers to cause a denial of service (program termination) via crafted ASN.1 BER datagrams that trigger an assertion error. | ||
| Family: | unix | Class: | vulnerability |
| Reference(s): | CVE-2008-2952 | Version: | 5 |
| Platform(s): | Red Hat Enterprise Linux 4 CentOS Linux 4 Oracle Linux 4 Red Hat Enterprise Linux 5 CentOS Linux 5 Oracle Linux 5 | Product(s): | |
| Definition Synopsis: | |||
| |||
| Definition Id: oval:org.mitre.oval:def:17439 | |||
| Oval ID: | oval:org.mitre.oval:def:17439 | ||
| Title: | USN-634-1 -- openldap2.2, openldap2.3 vulnerability | ||
| Description: | Cameron Hotchkies discovered that OpenLDAP did not correctly handle certain ASN.1 BER data. | ||
| Family: | unix | Class: | patch |
| Reference(s): | USN-634-1 CVE-2008-2952 | Version: | 7 |
| Platform(s): | Ubuntu 6.06 Ubuntu 7.04 Ubuntu 7.10 Ubuntu 8.04 | Product(s): | openldap2.2 openldap2.3 |
| Definition Synopsis: | |||
| |||
| Definition Id: oval:org.mitre.oval:def:18545 | |||
| Oval ID: | oval:org.mitre.oval:def:18545 | ||
| Title: | DSA-1650-1 openldap2.3 - denial of service | ||
| Description: | Cameron Hotchkies discovered that the OpenLDAP server slapd, a free implementation of the Lightweight Directory Access Protocol, could be crashed by sending malformed ASN1 requests. | ||
| Family: | unix | Class: | patch |
| Reference(s): | DSA-1650-1 CVE-2008-2952 | Version: | 7 |
| Platform(s): | Debian GNU/Linux 4.0 | Product(s): | openldap2.3 |
| Definition Synopsis: | |||
| Definition Id: oval:org.mitre.oval:def:22578 | |||
| Oval ID: | oval:org.mitre.oval:def:22578 | ||
| Title: | ELSA-2008:0583: openldap security update (Important) | ||
| Description: | liblber/io.c in OpenLDAP 2.2.4 to 2.4.10 allows remote attackers to cause a denial of service (program termination) via crafted ASN.1 BER datagrams that trigger an assertion error. | ||
| Family: | unix | Class: | patch |
| Reference(s): | ELSA-2008:0583-01 CVE-2008-2952 | Version: | 6 |
| Platform(s): | Oracle Linux 5 | Product(s): | openldap |
| Definition Synopsis: | |||
| |||
| Definition Id: oval:org.mitre.oval:def:29038 | |||
| Oval ID: | oval:org.mitre.oval:def:29038 | ||
| Title: | RHSA-2008:0583 -- openldap security update (Important) | ||
| Description: | Updated openldap packages that fix a security issue are now available for Red Hat Enterprise Linux 4 and 5. This update has been rated as having important security impact by the Red Hat Security Response Team. OpenLDAP is an open source suite of Lightweight Directory Access Protocol (LDAP) applications and development tools. LDAP is a set of protocols for accessing directory services. A denial of service flaw was found in the way the OpenLDAP slapd daemon processed certain network messages. An unauthenticated remote attacker could send a specially crafted request that would crash the slapd daemon. (CVE-2008-2952) Users of openldap should upgrade to these updated packages, which contain a backported patch to correct this issue. | ||
| Family: | unix | Class: | patch |
| Reference(s): | RHSA-2008:0583 CESA-2008:0583-CentOS 5 CVE-2008-2952 | Version: | 3 |
| Platform(s): | Red Hat Enterprise Linux 5 Red Hat Enterprise Linux 4 CentOS Linux 5 | Product(s): | openldap |
| Definition Synopsis: | |||
| |||
| Definition Id: oval:org.mitre.oval:def:8150 | |||
| Oval ID: | oval:org.mitre.oval:def:8150 | ||
| Title: | DSA-1650 openldap2.3 -- denial of service | ||
| Description: | Cameron Hotchkies discovered that the OpenLDAP server slapd, a free implementation of the Lightweight Directory Access Protocol, could be crashed by sending malformed ASN1 requests. | ||
| Family: | unix | Class: | patch |
| Reference(s): | DSA-1650 CVE-2008-2952 | Version: | 3 |
| Platform(s): | Debian GNU/Linux 4.0 | Product(s): | openldap2.3 |
| Definition Synopsis: | |||
CPE : Common Platform Enumeration
OpenVAS Exploits
| Date | Description |
|---|---|
| 2010-05-12 | Name : Mac OS X Security Update 2008-005 File : nvt/macosx_secupd_2008-005.nasl |
| 2009-11-17 | Name : Mac OS X Version File : nvt/macosx_version.nasl |
| 2009-10-13 | Name : SLES10: Security update for OpenLDAP 2 File : nvt/sles10_openldap20.nasl |
| 2009-10-10 | Name : SLES9: Security update for OpenLDAP 2 File : nvt/sles9p5036880.nasl |
| 2009-04-09 | Name : Mandriva Update for openldap MDVSA-2008:144 (openldap) File : nvt/gb_mandriva_MDVSA_2008_144.nasl |
| 2009-03-23 | Name : Ubuntu Update for openldap2.2, openldap2.3 vulnerability USN-634-1 File : nvt/gb_ubuntu_USN_634_1.nasl |
| 2009-03-06 | Name : RedHat Update for openldap RHSA-2008:0583-01 File : nvt/gb_RHSA-2008_0583-01_openldap.nasl |
| 2009-02-27 | Name : CentOS Update for compat-openldap CESA-2008:0583 centos4 i386 File : nvt/gb_CESA-2008_0583_compat-openldap_centos4_i386.nasl |
| 2009-02-27 | Name : CentOS Update for compat-openldap CESA-2008:0583 centos4 x86_64 File : nvt/gb_CESA-2008_0583_compat-openldap_centos4_x86_64.nasl |
| 2009-02-17 | Name : Fedora Update for openldap FEDORA-2008-6029 File : nvt/gb_fedora_2008_6029_openldap_fc8.nasl |
| 2009-02-17 | Name : Fedora Update for openldap FEDORA-2008-6062 File : nvt/gb_fedora_2008_6062_openldap_fc9.nasl |
| 2008-11-01 | Name : Debian Security Advisory DSA 1650-1 (openldap2.3) File : nvt/deb_1650_1.nasl |
| 2008-09-24 | Name : Gentoo Security Advisory GLSA 200808-09 (openldap) File : nvt/glsa_200808_09.nasl |
Open Source Vulnerability Database (OSVDB)
| Id | Description |
|---|---|
| 46689 | OpenLDAP ASN.1 BER Network Datagram Handling Remote DoS OpenLDAP contains a flaw that may allow a remote denial of service. The issue is triggered when an ASN.1 BER Network Datagram is handled unexpectedly, and will result in loss of availability for the service. |
Snort® IPS/IDS
| Date | Description |
|---|---|
| 2014-01-10 | OpenLDAP ber_get_next BER decoding denial of service attempt RuleID : 16197 - Revision : 9 - Type : SERVER-OTHER |
Nessus® Vulnerability Scanner
| Date | Description |
|---|---|
| 2013-07-12 | Name : The remote Oracle Linux host is missing one or more security updates. File : oraclelinux_ELSA-2008-0583.nasl - Type : ACT_GATHER_INFO |
| 2012-08-01 | Name : The remote Scientific Linux host is missing one or more security updates. File : sl_20080709_openldap_on_SL4_x.nasl - Type : ACT_GATHER_INFO |
| 2009-09-24 | Name : The remote SuSE 9 host is missing a security-related patch. File : suse9_12222.nasl - Type : ACT_GATHER_INFO |
| 2009-07-21 | Name : The remote openSUSE host is missing a security update. File : suse_11_0_openldap2-080813.nasl - Type : ACT_GATHER_INFO |
| 2009-04-23 | Name : The remote Mandriva Linux host is missing one or more security updates. File : mandriva_MDVSA-2008-144.nasl - Type : ACT_GATHER_INFO |
| 2008-10-17 | Name : The remote openSUSE host is missing a security update. File : suse_openldap2-5509.nasl - Type : ACT_GATHER_INFO |
| 2008-10-17 | Name : The remote SuSE 10 host is missing a security-related patch. File : suse_openldap2-5511.nasl - Type : ACT_GATHER_INFO |
| 2008-10-13 | Name : The remote Debian host is missing a security-related update. File : debian_DSA-1650.nasl - Type : ACT_GATHER_INFO |
| 2008-08-10 | Name : The remote Gentoo host is missing one or more security-related patches. File : gentoo_GLSA-200808-09.nasl - Type : ACT_GATHER_INFO |
| 2008-08-04 | Name : The remote Ubuntu host is missing one or more security-related patches. File : ubuntu_USN-634-1.nasl - Type : ACT_GATHER_INFO |
| 2008-08-01 | Name : The remote host is missing a Mac OS X update that fixes various security issues. File : macosx_SecUpd2008-005.nasl - Type : ACT_GATHER_INFO |
| 2008-07-15 | Name : The remote CentOS host is missing one or more security updates. File : centos_RHSA-2008-0583.nasl - Type : ACT_GATHER_INFO |
| 2008-07-10 | Name : The remote Red Hat host is missing one or more security updates. File : redhat-RHSA-2008-0583.nasl - Type : ACT_GATHER_INFO |
| 2008-07-08 | Name : The remote Fedora host is missing a security update. File : fedora_2008-6029.nasl - Type : ACT_GATHER_INFO |
| 2008-07-08 | Name : The remote Fedora host is missing a security update. File : fedora_2008-6062.nasl - Type : ACT_GATHER_INFO |
Sources (Detail)
Alert History
| Date | Informations |
|---|---|
| 2024-11-28 23:14:04 |
|
| 2024-11-28 12:15:55 |
|
| 2023-11-07 21:47:50 |
|
| 2021-05-04 12:07:41 |
|
| 2021-04-22 01:08:03 |
|
| 2020-05-23 00:21:54 |
|
| 2018-10-12 00:20:23 |
|
| 2017-09-29 09:23:37 |
|
| 2017-08-08 09:24:12 |
|
| 2016-04-26 17:35:23 |
|
| 2014-02-17 10:45:33 |
|
| 2014-01-19 21:25:05 |
|
| 2013-05-11 00:20:34 |
|
