Novell eDirectory NULL Base DN Denial Of Service Vulnerability

Bugtraq ID:	36902
Class:	Failure to Handle Exceptional Conditions
CVE:
Remote:	Yes
Local:	No
Published:	Nov 03 2009 12:00AM
Updated:	Nov 03 2009 05:27PM
Credit:	Anonymous
Vulnerable:	Novell eDirectory 8.8.2 ftf2 Novell eDirectory 8.8.2 Novell eDirectory 8.8.1 Novell eDirectory 8.7.3 SP10b Novell eDirectory 8.7.3 SP10 FTF1 Novell eDirectory 8.7.3 sp10 Novell eDirectory 8.7.3 .8 pre-SP9 Novell eDirectory 8.7.3 .8 Novell eDirectory 8.7.3 Novell eDirectory 8.8 SP5 Novell eDirectory 8.8 SP4 FTF1 Novell eDirectory 8.8 SP4 Novell eDirectory 8.8 SP3 FTF3 Novell eDirectory 8.8 SP3 Novell eDirectory 8.8 SP2 Novell eDirectory 8.8 SP1 Novell eDirectory 8.8 Novell eDirectory 8.7.3.9 Novell eDirectory 8.7.3.10b Hotfix 1 Novell eDirectory 8.7.3.10
Not Vulnerable:	Novell eDirectory 8.8.5 ftf1 Novell eDirectory 8.7.3.10 ftf2

Novell eDirectory NULL Base DN Denial Of Service Vulnerability

Novell eDirectory is prone to a denial-of-service vulnerability.

Remote attackers can exploit this issue to cause the server to become unresponsive, denying service to legitimate users.

Versions prior to Novell eDirectory 8.8.5 ftf1 and eDirectory 8.7.3.10 ftf2 are vulnerable.

Novell eDirectory NULL Base DN Denial Of Service Vulnerability

To exploit the issue, an attacker can use readily available network utilities.

Novell eDirectory NULL Base DN Denial Of Service Vulnerability

Solution:
Updates are available. Please see the references for details.

Novell eDirectory NULL Base DN Denial Of Service Vulnerability

References:

• Novell Homepage (Novell)
  
• Security Vulnerability: eDirectory LDAP Null Base DN Denial of Service (Novell)
  
• ZDI-09-075: Novell eDirectory LDAP Null Base DN Denial of Service Vulnerability (Zero Day Initiative)