Apple Mac OS X OpenLDAP Denial Of Service Vulnerability

Bugtraq ID:	18728
Class:	Failure to Handle Exceptional Conditions
CVE:	CVE-2006-1470
Remote:	Yes
Local:	No
Published:	Jun 27 2006 12:00AM
Updated:	Jun 29 2006 10:49PM
Credit:	Mu Security research is credited with the discovery of this vulnerability.
Vulnerable:	Apple Mac OS X Server 10.4.6 Apple Mac OS X Server 10.4.5 Apple Mac OS X Server 10.4.4 Apple Mac OS X Server 10.4.3 Apple Mac OS X Server 10.4.2 Apple Mac OS X Server 10.4.1 Apple Mac OS X Server 10.4 Apple Mac OS X 10.4.6 Apple Mac OS X 10.4.5 Apple Mac OS X 10.4.4 Apple Mac OS X 10.4.3 Apple Mac OS X 10.4.2 Apple Mac OS X 10.4.1 Apple Mac OS X 10.4
Not Vulnerable:	Apple Mac OS X Server 10.4.7 Apple Mac OS X 10.4.7

Apple Mac OS X OpenLDAP Denial Of Service Vulnerability

Mac OS X Open Directory Server is prone to a denial-of-service vulnerability because it fails to handle exceptional conditions.

An attacker can exploit this issue to cause a crash in the LDAP server, effectively denying service to legitimate users.

Apple has released Mac OS X version 10.4.7 to address this issue.

This issue was initially discussed in BID 18686 (Apple Mac OS X Multiple Security Vulnerabilities), which has been split into individual BIDs to discuss each issue separately.

Apple Mac OS X OpenLDAP Denial Of Service Vulnerability

Currently we are not aware of any exploits for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected]

• /data/vulnerabilities/exploits/FailureToLaunch.pl

Apple Mac OS X OpenLDAP Denial Of Service Vulnerability

Solution:
The vendor has released OS X version 10.4.7 to address this issue.


Apple Mac OS X Server 10.4

• Apple MacOSXSrvrUpdCombo10.4.7.dmg
  http://www.apple.com/support/downloads/

Apple Mac OS X 10.4

• Apple MacOSXUpdCombo10.4.7PPC.dmg
  for PowerPC
  http://www.apple.com/support/downloads/

Apple Mac OS X Server 10.4.1

• Apple MacOSXSrvrUpdCombo10.4.7.dmg
  http://www.apple.com/support/downloads/

Apple Mac OS X 10.4.1

• Apple MacOSXUpdCombo10.4.7PPC.dmg
  for PowerPC
  http://www.apple.com/support/downloads/

Apple Mac OS X 10.4.2

• Apple MacOSXUpdCombo10.4.7PPC.dmg
  for PowerPC
  http://www.apple.com/support/downloads/

Apple Mac OS X Server 10.4.2

• Apple MacOSXSrvrUpdCombo10.4.7.dmg
  http://www.apple.com/support/downloads/

Apple Mac OS X 10.4.3

• Apple MacOSXUpdCombo10.4.7PPC.dmg
  for PowerPC
  http://www.apple.com/support/downloads/

Apple Mac OS X Server 10.4.3

• Apple MacOSXSrvrUpdCombo10.4.7.dmg
  http://www.apple.com/support/downloads/

Apple Mac OS X Server 10.4.4

• Apple MacOSXSrvrUpdCombo10.4.7.dmg
  http://www.apple.com/support/downloads/

Apple Mac OS X 10.4.4

• Apple MacOSXUpdCombo10.4.7Intel.dmg
  http://www.apple.com/support/downloads/


• Apple MacOSXUpdCombo10.4.7PPC.dmg
  for PowerPC
  http://www.apple.com/support/downloads/

Apple Mac OS X Server 10.4.5

• Apple MacOSXSrvrUpdCombo10.4.7.dmg
  http://www.apple.com/support/downloads/

Apple Mac OS X 10.4.5

• Apple MacOSXUpdCombo10.4.7Intel.dmg
  http://www.apple.com/support/downloads/


• Apple MacOSXUpdCombo10.4.7PPC.dmg
  for PowerPC
  http://www.apple.com/support/downloads/

Apple Mac OS X Server 10.4.6

• Apple MacOSXServerUpdate10.4.7.dmg
  http://www.apple.com/support/downloads/


• Apple MacOSXSrvrUpdCombo10.4.7.dmg
  http://www.apple.com/support/downloads/

Apple Mac OS X 10.4.6

• Apple MacOSXUpd10.4.7Intel.dmg
  for Intel
  http://www.apple.com/support/downloads/


• Apple MacOSXUpd10.4.7PPC.dmg
  for PowerPC
  http://www.apple.com/support/downloads/


• Apple MacOSXUpdCombo10.4.7PPC.dmg
  for PowerPC
  http://www.apple.com/support/downloads/

Apple Mac OS X OpenLDAP Denial Of Service Vulnerability

References:

• Apple Downloads (Apple)
  
• Apple Security Updates (Apple)
  
• Mac OS X Homepage (Apple)