Isode M-Vault Server LDAP Memory Corruption Vulnerability

Bugtraq ID:	16635
Class:	Unknown
CVE:
Remote:	Yes
Local:	No
Published:	Feb 14 2006 12:00AM
Updated:	Feb 14 2006 10:28PM
Credit:	Discovery is credited to Evgeny Legerov.
Vulnerable:	Isode M-Vault Server 11.3
Not Vulnerable:

Isode M-Vault Server LDAP Memory Corruption Vulnerability

Isode M-Vault Server is prone to a memory corruption. This issue may be triggered by malformed LDAP data.

The exact impact of this vulnerability is not known at this time. Although the issue is known to crash the server, the possibility of remote code execution is unconfirmed.

The vulnerability was reported for version 11.3 on the Linux platform; other versions and platforms may also be affected.

This vulnerability will be updated as further information is made available.

Isode M-Vault Server LDAP Memory Corruption Vulnerability

This issue can be reproduced by running the following command for the ProtoVer Sample LDAP test suite:

./run.py localhost 389 3102 1

Isode M-Vault Server LDAP Memory Corruption Vulnerability

Solution:
Currently we are not aware of any vendor-supplied patches for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected]

Isode M-Vault Server LDAP Memory Corruption Vulnerability

References:

• [Dailydave] eddy 0day (Evgeny Legerov)
  
• Isode M-Vault Server Product Page (Isode)
  
• ProtoVer Sample LDAP testsuite (Gleg Ltd)