Show filters
8 Total Results
Displaying 1-8 of 8
Sort by:
Attacker Value
Unknown
CVE-2013-4449
Disclosure Date: February 05, 2014 (last updated October 05, 2023)
The rwm overlay in OpenLDAP 2.4.23, 2.4.36, and earlier does not properly count references, which allows remote attackers to cause a denial of service (slapd crash) by unbinding immediately after a search request, which triggers rwm_conn_destroy to free the session context while it is being used by rwm_op_search.
1
Attacker Value
Unknown
CVE-2012-1164
Disclosure Date: June 29, 2012 (last updated October 04, 2023)
slapd in OpenLDAP before 2.4.30 allows remote attackers to cause a denial of service (assertion failure and daemon exit) via an LDAP search query with attrsOnly set to true, which causes empty attributes to be returned.
0
Attacker Value
Unknown
CVE-2012-2668
Disclosure Date: June 17, 2012 (last updated October 04, 2023)
libraries/libldap/tls_m.c in OpenLDAP, possibly 2.4.31 and earlier, when using the Mozilla NSS backend, always uses the default cipher suite even when TLSCipherSuite is set, which might cause OpenLDAP to use weaker ciphers than intended and make it easier for remote attackers to obtain sensitive information.
0
Attacker Value
Unknown
CVE-2011-4079
Disclosure Date: October 27, 2011 (last updated October 04, 2023)
Off-by-one error in the UTF8StringNormalize function in OpenLDAP 2.4.26 and earlier allows remote attackers to cause a denial of service (slapd crash) via a zero-length string that triggers a heap-based buffer overflow, as demonstrated using an empty postalAddressAttribute value in an LDIF entry.
0
Attacker Value
Unknown
CVE-2011-1024
Disclosure Date: March 20, 2011 (last updated October 04, 2023)
chain.c in back-ldap in OpenLDAP 2.4.x before 2.4.24, when a master-slave configuration with a chain overlay and ppolicy_forward_updates (aka authentication-failure forwarding) is used, allows remote authenticated users to bypass external-program authentication by sending an invalid password to a slave server.
0
Attacker Value
Unknown
CVE-2011-1025
Disclosure Date: March 20, 2011 (last updated October 04, 2023)
bind.cpp in back-ndb in OpenLDAP 2.4.x before 2.4.24 does not require authentication for the root Distinguished Name (DN), which allows remote attackers to bypass intended access restrictions via an arbitrary password.
0
Attacker Value
Unknown
CVE-2011-1081
Disclosure Date: March 20, 2011 (last updated October 04, 2023)
modrdn.c in slapd in OpenLDAP 2.4.x before 2.4.24 allows remote attackers to cause a denial of service (daemon crash) via a relative Distinguished Name (DN) modification request (aka MODRDN operation) that contains an empty value for the OldDN field.
0
Attacker Value
Unknown
CVE-2008-2952
Disclosure Date: July 01, 2008 (last updated October 04, 2023)
liblber/io.c in OpenLDAP 2.2.4 to 2.4.10 allows remote attackers to cause a denial of service (program termination) via crafted ASN.1 BER datagrams that trigger an assertion error.
0
