Sun ONE Directory Server Remote Denial Of Service Vulnerability

Bugtraq ID:	16550
Class:	Failure to Handle Exceptional Conditions
CVE:	CVE-2006-0647
Remote:	Yes
Local:	No
Published:	Feb 08 2006 12:00AM
Updated:	Apr 13 2007 10:51PM
Credit:	Discovery is credited to Evgeny Legerov <[email protected]>.
Vulnerable:	Sun ONE Directory Server 5.2 patch 4 Sun ONE Directory Server 5.2 patch 3 Sun ONE Directory Server 5.2 Sun Java System Directory Server 5.2 Patch2 Sun Java System Directory Server 5.2 2005Q4 Sun Java System Directory Server 5.2 2005Q1 Sun Java System Directory Server 5.2 2004Q2 Sun Java System Directory Server 5.2 2003Q4 Sun Java System Directory Server 5.2
Not Vulnerable:

Sun ONE Directory Server Remote Denial Of Service Vulnerability

Sun ONE Directory Server is prone to a remote denial-of-service vulnerability. This issue is due to the application's failure to handle malformed network traffic.

This issue allows remote attackers to crash the application, denying service to legitimate users.

Sun ONE Directory Server Remote Denial Of Service Vulnerability

An exploit is not required.

Sample Python code has been provided by Evgeny Legerov that may demonstrate this issue:

from socket import *

Sun ONE Directory Server Remote Denial Of Service Vulnerability

Solution:
Sun has released an advisory to address this issue.


Sun Java System Directory Server 5.2 2005Q4

• Sun 122476-01
  http://sunsolve.sun.com/search/document.do?assetkey=urn:cds:docid:1-21 -122476-01-1

Sun ONE Directory Server Remote Denial Of Service Vulnerability

References:

• [Dailydave] ??? Sun Directory Server 5.2 fun ??? (Evgeny Legerov)
  
• [Dailydave] Sun Directory Server 5.2 fun (Evgeny Legerov )
  
• Sun Java System Directory Server Homepage (Sun)
  
• Sun Alert ID: 102294 Sun Java System Directory Server: Denial of Service May Occ (Sun)