Attacker Value

Unknown

(0 users assessed)

Exploitability

Unknown

(0 users assessed)

User Interaction

Unknown

Privileges Required

Unknown

Attack Vector

Unknown

1

CVE-2013-4449

Disclosure Date: February 05, 2014 •

MITRE ATT&CK

Add MITRE ATT&CK tactics and techniques that apply to this CVE.

Description

The rwm overlay in OpenLDAP 2.4.23, 2.4.36, and earlier does not properly count references, which allows remote attackers to cause a denial of service (slapd crash) by unbinding immediately after a search request, which triggers rwm_conn_destroy to free the session context while it is being used by rwm_op_search.

Add Assessment

No one has assessed this topic. Be the first to add your voice to the community.

CVSS V3 Severity and Metrics

Data provided by the National Vulnerability Database (NVD)

Base Score:

None

Impact Score:

Unknown

Exploitability Score:

Unknown

Vector:

Attack Vector (AV):

Unknown

Attack Complexity (AC):

Unknown

Privileges Required (PR):

Unknown

User Interaction (UI):

Unknown

Scope (S):

Unknown

Confidentiality (C):

Unknown

Integrity (I):

Unknown

Availability (A):

Unknown

References

Canonical

CVE-2013-4449 (https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-4449)

BID-63190 (http://www.securityfocus.com/bid/63190)

Advisory

http://www.oracle.com/technetwork/topics/security/ovmbulletinjul2016-3090546.html

http://www.openldap.org/its/index.cgi/Incoming?id=7723

http://www.mandriva.com/security/advisories?name=MDVSA-2014:026

https://bugzilla.redhat.com/show_bug.cgi?id=1019490

DSA-3209 (http://www.debian.org/security/2015/dsa-3209)

http://rhn.redhat.com/errata/RHSA-2014-0126.html

[oss-security] 20131018 Re: CVE request: slapd segfaults on certain queries with rwm overlay enabled (http://www.openwall.com/lists/oss-security/2013/10/19/3)

http://rhn.redhat.com/errata/RHSA-2014-0206.html

http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10705

SECTRACK-1029711 (http://www.securitytracker.com/id/1029711)

20140401 Cisco Unified Communications Manager Denial of Service Vulnerability (http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2013-4449)

http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10735

https://support.apple.com/kb/HT210788

20191211 APPLE-SA-2019-12-10-3 macOS Catalina 10.15.2, Security Update 2019-002 Mojave, Security Update 2019-007 High Sierra (https://seclists.org/bugtraq/2019/Dec/23)

20191213 APPLE-SA-2019-12-10-3 macOS Catalina 10.15.2, Security Update 2019-002 Mojave, Security Update 2019-007 High Sierra (http://seclists.org/fulldisclosure/2019/Dec/26)

Rapid7

Technical Analysis