Vulnerability Description
389-ds-base before versions 1.3.5.17 and 1.3.6.10 is vulnerable to an invalid pointer dereference in the way LDAP bind requests are handled. A remote unauthenticated attacker could use this flaw to make ns-slapd crash via a specially crafted LDAP bind request, resulting in denial of service.
CVSS Score
MEDIUM
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Fedoraproject | 389 Directory Server | >= 1.3.5.0, < 1.3.5.17 |
| Redhat | Enterprise Linux Desktop | 6.0 |
| Redhat | Enterprise Linux Server | 6.0 |
| Redhat | Enterprise Linux Workstation | 6.0 |
Related Weaknesses (CWE)
References
- http://www.securityfocus.com/bid/97524Third Party AdvisoryVDB Entry
- https://access.redhat.com/errata/RHSA-2017:0893Third Party Advisory
- https://access.redhat.com/errata/RHSA-2017:0920Third Party Advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2017-2668Issue TrackingThird Party Advisory
- https://pagure.io/389-ds-base/issue/49220Issue TrackingThird Party Advisory
- http://www.securityfocus.com/bid/97524Third Party AdvisoryVDB Entry
- https://access.redhat.com/errata/RHSA-2017:0893Third Party Advisory
- https://access.redhat.com/errata/RHSA-2017:0920Third Party Advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2017-2668Issue TrackingThird Party Advisory
- https://pagure.io/389-ds-base/issue/49220Issue TrackingThird Party Advisory
FAQ
What is CVE-2017-2668?
CVE-2017-2668 is a vulnerability with a CVSS score of 6.5 (MEDIUM). 389-ds-base before versions 1.3.5.17 and 1.3.6.10 is vulnerable to an invalid pointer dereference in the way LDAP bind requests are handled. A remote unauthenticated attacker could use this flaw to ma...
How severe is CVE-2017-2668?
CVE-2017-2668 has been rated MEDIUM with a CVSS base score of 6.5/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2017-2668?
Check the references section above for vendor advisories and patch information. Affected products include: Fedoraproject 389 Directory Server, Redhat Enterprise Linux Desktop, Redhat Enterprise Linux Server, Redhat Enterprise Linux Workstation.