Executive Summary



This Alert is flagged as TOP 25 Common Weakness Enumeration from CWE/SANS. For more information, you can read this.
Informations
Name CVE-2013-4449 First vendor Publication 2014-02-05
Vendor Cve Last vendor Modification 2016-12-08

Security-Database Scoring CVSS v3

Cvss vector : N/A
Overall CVSS Score NA
Base Score NA Environmental Score NA
impact SubScore NA Temporal Score NA
Exploitabality Sub Score NA
 
Calculate full CVSS 3.0 Vectors scores

Security-Database Scoring CVSS v2

Cvss vector : (AV:N/AC:M/Au:N/C:N/I:N/A:P)
Cvss Base Score 4.3 Attack Range Network
Cvss Impact Score 2.9 Attack Complexity Medium
Cvss Expoit Score 8.6 Authentication None Required
Calculate full CVSS 2.0 Vectors scores

Detail

The rwm overlay in OpenLDAP 2.4.23, 2.4.36, and earlier does not properly count references, which allows remote attackers to cause a denial of service (slapd crash) by unbinding immediately after a search request, which triggers rwm_conn_destroy to free the session context while it is being used by rwm_op_search.

Original Source

Url : http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-4449

CWE : Common Weakness Enumeration

% Id Name
100 % CWE-189 Numeric Errors (CWE/SANS Top 25)

OVAL Definitions

Definition Id: oval:org.mitre.oval:def:22531
 
Oval ID: oval:org.mitre.oval:def:22531
Title: RHSA-2014:0126: openldap security and bug fix update (Moderate)
Description: The rwm overlay in OpenLDAP 2.4.23, 2.4.36, and earlier does not properly count references, which allows remote attackers to cause a denial of service (slapd crash) by unbinding immediately after a search request, which triggers rwm_conn_destroy to free the session context while it is being used by rwm_op_search.
Family: unix Class: patch
Reference(s): RHSA-2014:0126-00
CESA-2014:0126
CVE-2013-4449
 Version: 8
Platform(s): Red Hat Enterprise Linux 6
CentOS Linux 6
 Product(s): openldap
Definition Synopsis:
Definition Id: oval:org.mitre.oval:def:23794
 
Oval ID: oval:org.mitre.oval:def:23794
Title: ELSA-2014:0126: openldap security and bug fix update (Moderate)
Description: The rwm overlay in OpenLDAP 2.4.23, 2.4.36, and earlier does not properly count references, which allows remote attackers to cause a denial of service (slapd crash) by unbinding immediately after a search request, which triggers rwm_conn_destroy to free the session context while it is being used by rwm_op_search.
Family: unix Class: patch
Reference(s): ELSA-2014:0126-00
CVE-2013-4449
 Version: 6
Platform(s): Oracle Linux 6
 Product(s): openldap
Definition Synopsis:
Definition Id: oval:org.mitre.oval:def:24289
 
Oval ID: oval:org.mitre.oval:def:24289
Title: ELSA-2014:0206: openldap security update (Moderate)
Description: OpenLDAP is an open source suite of Lightweight Directory Access Protocol (LDAP) applications and development tools. LDAP is a set of protocols used to access and maintain distributed directory information services over an IP network. The openldap package contains configuration files, libraries, and documentation for OpenLDAP. A denial of service flaw was found in the way the OpenLDAP server daemon (slapd) performed reference counting when using the rwm (rewrite/remap) overlay. A remote attacker able to query the OpenLDAP server could use this flaw to crash the server by immediately unbinding from the server after sending a search request. (CVE-2013-4449) Red Hat would like to thank Michael Vishchers from Seven Principles AG for reporting this issue. All openldap users are advised to upgrade to these updated packages, which contain a backported patch to correct this issue.
Family: unix Class: patch
Reference(s): ELSA-2014:0206-00
CVE-2013-4449
 Version: 5
Platform(s): Oracle Linux 5
 Product(s): openldap
Definition Synopsis:
Definition Id: oval:org.mitre.oval:def:24327
 
Oval ID: oval:org.mitre.oval:def:24327
Title: RHSA-2014:0206: openldap security update (Moderate)
Description: The rwm overlay in OpenLDAP 2.4.23, 2.4.36, and earlier does not properly count references, which allows remote attackers to cause a denial of service (slapd crash) by unbinding immediately after a search request, which triggers rwm_conn_destroy to free the session context while it is being used by rwm_op_search.
Family: unix Class: patch
Reference(s): RHSA-2014:0206-00
CESA-2014:0206
CVE-2013-4449
 Version: 7
Platform(s): Red Hat Enterprise Linux 5
CentOS Linux 5
 Product(s): openldap
Definition Synopsis:
Definition Id: oval:org.mitre.oval:def:27309
 
Oval ID: oval:org.mitre.oval:def:27309
Title: DEPRECATED: ELSA-2014-0126 -- openldap security and bug fix update (moderate)
Description: [2.4.23-34.1] - fix: segfault on certain queries with rwm overlay (#1058250) [2.4.23-34] - fix: deadlock during SSL_ForceHandshake (#996373) + revert nss-handshake-threadsafe.patch
Family: unix Class: patch
Reference(s): ELSA-2014-0126
CVE-2013-4449
 Version: 4
Platform(s): Oracle Linux 6
 Product(s): openldap
Definition Synopsis:
Definition Id: oval:org.mitre.oval:def:27346
 
Oval ID: oval:org.mitre.oval:def:27346
Title: DEPRECATED: ELSA-2014-0206 -- openldap security update (moderate)
Description: [2.3.43-27] - fix: CVE-2013-4449 segfault on certain queries with rwm overlay (#1064145) [2.3.43-26] - fix: do not send IPv6 DNS queries when IPv6 is disabled on the host (#812772)
Family: unix Class: patch
Reference(s): ELSA-2014-0206
CVE-2013-4449
 Version: 4
Platform(s): Oracle Linux 5
 Product(s): openldap
Definition Synopsis:

CPE : Common Platform Enumeration

TypeDescriptionCount
Application 197
Os 2

Nessus® Vulnerability Scanner

Date Description
2016-06-22 Name : The remote OracleVM host is missing one or more security updates.
File : oraclevm_OVMSA-2016-0069.nasl - Type : ACT_GATHER_INFO
2015-05-27 Name : The remote Ubuntu host is missing a security-related patch.
File : ubuntu_USN-2622-1.nasl - Type : ACT_GATHER_INFO
2015-05-18 Name : The remote SuSE 11 host is missing one or more security updates.
File : suse_11_openldap2-20150423-150413.nasl - Type : ACT_GATHER_INFO
2015-04-20 Name : The remote Debian host is missing a security update.
File : debian_DLA-203.nasl - Type : ACT_GATHER_INFO
2015-03-31 Name : The remote Debian host is missing a security-related update.
File : debian_DSA-3209.nasl - Type : ACT_GATHER_INFO
2014-03-11 Name : The remote Fedora host is missing a security update.
File : fedora_2014-2967.nasl - Type : ACT_GATHER_INFO
2014-03-02 Name : The remote Amazon Linux AMI host is missing a security update.
File : ala_ALAS-2014-294.nasl - Type : ACT_GATHER_INFO
2014-02-25 Name : The remote Red Hat host is missing one or more security updates.
File : redhat-RHSA-2014-0206.nasl - Type : ACT_GATHER_INFO
2014-02-25 Name : The remote Scientific Linux host is missing one or more security updates.
File : sl_20140224_openldap_on_SL5_x.nasl - Type : ACT_GATHER_INFO
2014-02-25 Name : The remote Oracle Linux host is missing one or more security updates.
File : oraclelinux_ELSA-2014-0206.nasl - Type : ACT_GATHER_INFO
2014-02-25 Name : The remote CentOS host is missing one or more security updates.
File : centos_RHSA-2014-0206.nasl - Type : ACT_GATHER_INFO
2014-02-13 Name : The remote Mandriva Linux host is missing one or more security updates.
File : mandriva_MDVSA-2014-026.nasl - Type : ACT_GATHER_INFO
2014-02-12 Name : The remote Fedora host is missing a security update.
File : fedora_2014-2012.nasl - Type : ACT_GATHER_INFO
2014-02-04 Name : The remote CentOS host is missing one or more security updates.
File : centos_RHSA-2014-0126.nasl - Type : ACT_GATHER_INFO
2014-02-04 Name : The remote Scientific Linux host is missing one or more security updates.
File : sl_20140203_openldap_on_SL6_x.nasl - Type : ACT_GATHER_INFO
2014-02-04 Name : The remote Red Hat host is missing one or more security updates.
File : redhat-RHSA-2014-0126.nasl - Type : ACT_GATHER_INFO
2014-02-04 Name : The remote Oracle Linux host is missing one or more security updates.
File : oraclelinux_ELSA-2014-0126.nasl - Type : ACT_GATHER_INFO

Sources (Detail)

Source Url
BID http://www.securityfocus.com/bid/63190
BUGTRAQ https://seclists.org/bugtraq/2019/Dec/23
CISCO http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2013-4449
CONFIRM http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10705
http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10735
http://www.openldap.org/its/index.cgi/Incoming?id=7723
http://www.oracle.com/technetwork/topics/security/ovmbulletinjul2016-3090546....
https://bugzilla.redhat.com/show_bug.cgi?id=1019490
https://support.apple.com/kb/HT210788
DEBIAN http://www.debian.org/security/2015/dsa-3209
FULLDISC http://seclists.org/fulldisclosure/2019/Dec/26
MANDRIVA http://www.mandriva.com/security/advisories?name=MDVSA-2014:026
MLIST http://www.openwall.com/lists/oss-security/2013/10/19/3
REDHAT http://rhn.redhat.com/errata/RHSA-2014-0126.html
http://rhn.redhat.com/errata/RHSA-2014-0206.html
SECTRACK http://www.securitytracker.com/id/1029711

Alert History

If you want to see full details history, please login or register.
0
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
Date Informations
2021-05-05 01:13:20
  • Multiple Updates
2021-05-04 12:27:19
  • Multiple Updates
2021-04-22 01:33:05
  • Multiple Updates
2020-05-24 01:12:04
  • Multiple Updates
2020-05-23 00:38:02
  • Multiple Updates
2019-08-09 12:05:43
  • Multiple Updates
2016-12-08 09:23:28
  • Multiple Updates
2016-12-03 09:23:54
  • Multiple Updates
2016-09-09 09:23:16
  • Multiple Updates
2016-06-28 19:39:50
  • Multiple Updates
2016-06-23 13:29:27
  • Multiple Updates
2016-04-04 17:23:41
  • Multiple Updates
2015-05-28 13:27:45
  • Multiple Updates
2015-05-19 13:27:44
  • Multiple Updates
2015-04-21 13:28:04
  • Multiple Updates
2015-04-03 09:26:08
  • Multiple Updates
2015-04-02 13:27:37
  • Multiple Updates
2014-04-19 13:23:54
  • Multiple Updates
2014-03-18 13:22:47
  • Multiple Updates
2014-03-12 13:21:28
  • Multiple Updates
2014-03-06 13:22:45
  • Multiple Updates
2014-03-02 13:23:39
  • Multiple Updates
2014-02-26 13:21:14
  • Multiple Updates
2014-02-17 11:22:12
  • Multiple Updates
2014-02-14 17:20:43
  • Multiple Updates
2014-02-06 21:20:57
  • Multiple Updates
2014-02-05 21:20:58
  • First insertion