SecurityTracker.com
Keep Track of the Latest Vulnerabilities
with SecurityTracker!
    Home    |    View Topics    |    Search    |    Contact Us    |   

SecurityTracker
Archives


 
Sign Up
Sign Up for Your FREE Weekly SecurityTracker E-mail Alert Summary
Instant Alerts
Buy our Premium Vulnerability Notification Service to receive customized, instant alerts
Affiliates
Put SecurityTracker Vulnerability Alerts on Your Web Site -- It's Free!
Partners
Become a Partner and License Our Database or Notification Service
Report a Bug
Report a vulnerability that you have found to SecurityTracker
bugs
@
securitytracker.com






Category:   Application (Directory)  >   Sun ONE Directory Server Vendors:   Sun
Sun Java System Directory Server Lets Remote Users Crash the ns-slapd Service
SecurityTracker Alert ID:  1017814
SecurityTracker URL:  http://securitytracker.com/id/1017814
CVE Reference:   CVE-2006-4175   (Links to External Site)
Updated:  May 2 2007
Original Entry Date:  Mar 23 2007
Impact:   Denial of service via network
Fix Available:  Yes  Vendor Confirmed:  Yes  
Version(s): 5.2 2005Q4, possibly other versions
Description:   A vulnerability was reported in Sun Java System Directory Server. A remote user can cause denial of service conditions.

A remote user can send specially crafted queries to cause the target ns-slapd service to crash.

In some cases, the vulnerability may possibly permit remote code execution, but the report did not confirm code execution.

The vendor was notified on August 16, 20006.

iDefense reported this vulnerability.

Impact:   A remote user can cause the target directory service to crash.
Solution:   The vendor has issued a fix (5.2 Patch5).

For the Native Package Versions:

* Solaris Sparc: 115614-27
* Solaris x86: 115615-27
* Linux: 118080-12
* HP-UX : 121393-02

For the PatchZIP (Compressed Archive) versions:

* Linux: 117668-04
* Windows: 117667-04
* HP-UX: 117669-04
* AIX: 117670-04

Sun is working on a final resolution.

The Sun advisory is available at:

http://sunsolve.sun.com/search/document.do?assetkey=1-26-102853-1

Vendor URL:  sunsolve.sun.com/search/document.do?assetkey=1-26-102853-1 (Links to External Site)
Cause:   Access control error
Underlying OS:   Linux (Any), UNIX (AIX), UNIX (HP/UX), UNIX (Solaris - SunOS), Windows (Any)

Message History:   None.


 Source Message Contents

Date:  Fri, 23 Mar 2007 14:11:38 -0400
Subject:  [Full-disclosure] iDefense Security Advisory 03.23.07: Sun Java

Sun Java System Directory Server 5.2 Uninitialized Pointer Cleanup
Design Error Vulnerability

iDefense Security Advisory 03.23.07
http://labs.idefense.com/intelligence/vulnerabilities/
Mar 23, 2007

I. BACKGROUND

Sun Java System Directory Server is an LDAP server distributed by Sun with
multiple products. More information is available at the following URL.

http://www.sun.com/software/products/directory_srvr/home_directory.xml

II. DESCRIPTION

Remote exploitation of a design error vulnerability in Sun Microsystems
Inc.'s
Java System Directory Server 5.2 may cause a denial of service (DoS)
condition.

Due to a design error in the clean-up code following certain types of failed
queries, it is possible to cause the server to call the free() function
on an
address obtained from uninitialized memory. This can result in an invalid
memory reference leading to denial of service.

III. ANALYSIS

Exploitation of this vulnerability allows remote attackers to cause a denial
of service against the affected server, 'ns-slapd'.

In some situations it may be possible to put information from the remote
attacker in the memory range being accessed which may allow execution of
code, however this has not yet been demonstrated.

IV. DETECTION

iDefense has confirmed Sun Java System Directory Server 5.2 Directory Server
5.2 2005Q4 is affected by this vulnerability. Previous versions are also
suspected to be vulnerable.

V. WORKAROUND

Restrict remote access at the network boundary, unless remote parties
require
service. Access to the affected host should be filtered at the network
boundary if global accessibility is not required. Restricting access to only
trusted hosts and networks may reduce the likelihood of exploitation.

VI. VENDOR RESPONSE

Sun Microsystems Inc. has addressed this issue in Sun Java System Directory
Server 5.2 Patch5. For more information see Sun Alert ID 102853 by visiting
the URL shown below.

http://sunsolve.sun.com/search/document.do?assetkey=1-26-102853-1

VII. CVE INFORMATION

The Common Vulnerabilities and Exposures (CVE) project has assigned the
name CVE-2006-4175 to this issue. This is a candidate for inclusion in
the CVE list (http://cve.mitre.org/), which standardizes names for
security problems.

VIII. DISCLOSURE TIMELINE

08/16/2006  Initial vendor notification
08/21/2006  Initial vendor response
03/23/2007  Coordinated public disclosure

IX. CREDIT

The discoverer of this vulnerability wishes to remain anonymous.

Get paid for vulnerability research
http://labs.idefense.com/methodology/vulnerability/vcp.php

Free tools, research and upcoming events
http://labs.idefense.com/

X. LEGAL NOTICES

Copyright  2007 iDefense, Inc.

Permission is granted for the redistribution of this alert electronically.
It may not be edited in any way without the express written consent of
iDefense. If you wish to reprint the whole or any part of this alert in
any other medium other than electronically, please e-mail
customerservice@idefense.com for permission.

Disclaimer: The information in the advisory is believed to be accurate at
the time of publishing based on currently available information. Use of
the information constitutes acceptance for use in an AS IS condition.
There are no warranties with regard to this information. Neither the
author nor the publisher accepts any liability for any direct, indirect,
or consequential loss or damage arising from use of, or reliance on, this
information.

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/

 
 


Go to the Top of This SecurityTracker Archive Page





Home   |    View Topics   |    Search   |    Contact Us

Copyright 2014, SecurityGlobal.net LLC