Fedora Directory Server Multiple Remote Denial Of Service Vulnerabilities

Bugtraq ID:	16677
Class:	Unknown
CVE:	CVE-2006-0451 CVE-2006-0452 CVE-2006-0453
Remote:	Yes
Local:	No
Published:	Feb 15 2006 12:00AM
Updated:	Feb 16 2006 04:12PM
Credit:	Discovery is credited to Evgeny Legerov.
Vulnerable:	Redhat Fedora Directory Server 1.0
Not Vulnerable:

Fedora Directory Server Multiple Remote Denial Of Service Vulnerabilities

Fedora Directory Server is prone to multiple remote denial-of-service vulnerabilities. These issues may be triggered by malformed LDAP data.

These issues allow remote attackers to crash affected servers or to consume excessive CPU and memory resources. This will deny further service to legitimate users.

Fedora Directory Server Multiple Remote Denial Of Service Vulnerabilities

These issues can be reproduced by utilizing the ProtoVer LDAP test suite.

Fedora Directory Server Multiple Remote Denial Of Service Vulnerabilities

Solution:
The vendor has released patches to address these issues. Please see the referenced Bugzilla bugs for further information.

Fedora Directory Server Multiple Remote Denial Of Service Vulnerabilities

References:

• Bugzilla Bug 179135 �?? CVE-2006-0451 memory leaks using ber_scanf when handling b (RedHat)
  
• Bugzilla Bug 179137 �?? CVE-2006-0452 recursion causes OOM with bad DN in dn2ances (RedHat)
  
• Fedora Directory Server Home Page (RedHat)
  
• ProtoVer Sample LDAP testsuite (Gleg Ltd)