Vulnerability CVE-2001-0977 - CERT Civis.Net

Vulnerability Name:

CVE-2001-0977 (CCN-6904)

Assigned:

2001-07-16

Published:

2001-07-16

Updated:

2017-10-10

Summary:

slapd in OpenLDAP 1.x before 1.2.12, and 2.x before 2.0.8, allows remote attackers to cause a denial of service (crash) via an invalid Basic Encoding Rules (BER) length field.

CVSS v3 Severity:

5.3 Medium (CCN CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L)

Exploitability Metrics:	Attack Vector (AV): Network Attack Complexity (AC): Low Privileges Required (PR): None User Interaction (UI): None
Scope:	Scope (S): Unchanged
Impact Metrics:	Confidentiality (C): None Integrity (I): None Availibility (A): Low

CVSS v2 Severity:

5.0 Medium (CVSS v2 Vector: AV:N/AC:L/Au:N/C:N/I:N/A:P)

Exploitability Metrics:	Access Vector (AV): Network Access Complexity (AC): Low Authentication (Au): None
Impact Metrics:	Confidentiality (C): None Integrity (I): None Availibility (A): Partial

5.0 Medium (CCN CVSS v2 Vector: AV:N/AC:L/Au:N/C:N/I:N/A:P)

Exploitability Metrics:	Access Vector (AV): Network Access Complexity (AC): Low Athentication (Au): None
Impact Metrics:	Confidentiality (C): None Integrity (I): None Availibility (A): Partial

Vulnerability Type:

Vulnerability Consequences:

Denial of Service

References:

Source: MITRE
Type: CNA
CVE-2001-0977

Source: CONECTIVA
Type: UNKNOWN
CLA-2001:417

Source: CCN
Type: Conectiva Linux Announcement CLSA-2001:417
Remote DoS vulnerability in openldap

Source: CCN
Type: RHSA-2001-098
Updated OpenLDAP packages available for Red Hat Linux 6.2

Source: CCN
Type: CERT Advisory CA-2001-18
Multiple Vulnerabilities in Several Implementations of the Lightweight Directory Access Protocol (LDAP)

Source: CERT
Type: Patch, Third Party Advisory, US Government Resource
CA-2001-18

Source: CCN
Type: CIAC Information Bulletin L-116
Lightweight Directory Access Protocol (LDAP) Vulnerabilities

Source: DEBIAN
Type: UNKNOWN
DSA-068

Source: DEBIAN
Type: DSA-068
openldap -- remote DoS

Source: CCN
Type: US-CERT VU#935800
Multiple versions of OpenLDAP are vulnerable to denial-of-service attacks

Source: CERT-VN
Type: Patch, Third Party Advisory, US Government Resource
VU#935800

Source: MANDRAKE
Type: Patch, Vendor Advisory
MDKSA-2001:069

Source: OSVDB
Type: UNKNOWN
1905

Source: CCN
Type: OSVDB ID: 1905
OpenLDAP slapd Invalid BER Length Field DoS

Source: REDHAT
Type: UNKNOWN
RHSA-2001:098

Source: BID
Type: Patch, Vendor Advisory
3049

Source: CCN
Type: BID-3049
OpenLDAP Denial of Service Vulnerabilities

Source: XF
Type: UNKNOWN
openldap-ldap-protos-dos(6904)

Source: XF
Type: UNKNOWN
openldap-ldap-protos-dos(6904)

Vulnerable Configuration:

Configuration 1:

cpe:/a:mandrakesoft:mandrake_single_network_firewall:7.2:*:*:*:*:*:*:*

OR cpe:/a:openldap:openldap:1.0:*:*:*:*:*:*:*

OR cpe:/a:openldap:openldap:1.0.1:*:*:*:*:*:*:*

OR cpe:/a:openldap:openldap:1.0.2:*:*:*:*:*:*:*

OR cpe:/a:openldap:openldap:1.0.3:*:*:*:*:*:*:*

OR cpe:/a:openldap:openldap:1.1:*:*:*:*:*:*:*

OR cpe:/a:openldap:openldap:1.1.1:*:*:*:*:*:*:*

OR cpe:/a:openldap:openldap:1.1.2:*:*:*:*:*:*:*

OR cpe:/a:openldap:openldap:1.1.3:*:*:*:*:*:*:*

OR cpe:/a:openldap:openldap:1.1.4:*:*:*:*:*:*:*

OR cpe:/a:openldap:openldap:1.2:*:*:*:*:*:*:*

OR cpe:/a:openldap:openldap:1.2.1:*:*:*:*:*:*:*

OR cpe:/a:openldap:openldap:1.2.2:*:*:*:*:*:*:*

OR cpe:/a:openldap:openldap:1.2.3:*:*:*:*:*:*:*

OR cpe:/a:openldap:openldap:1.2.4:*:*:*:*:*:*:*

OR cpe:/a:openldap:openldap:1.2.5:*:*:*:*:*:*:*

OR cpe:/a:openldap:openldap:1.2.6:*:*:*:*:*:*:*

OR cpe:/a:openldap:openldap:1.2.7:*:*:*:*:*:*:*

OR cpe:/a:openldap:openldap:1.2.8:*:*:*:*:*:*:*

OR cpe:/a:openldap:openldap:1.2.9:*:*:*:*:*:*:*

OR cpe:/a:openldap:openldap:1.2.10:*:*:*:*:*:*:*

OR cpe:/a:openldap:openldap:1.2.11:*:*:*:*:*:*:*

OR cpe:/a:openldap:openldap:1.2.12:*:*:*:*:*:*:*

OR cpe:/a:openldap:openldap:2.0:*:*:*:*:*:*:*

OR cpe:/a:openldap:openldap:2.0.1:*:*:*:*:*:*:*

OR cpe:/a:openldap:openldap:2.0.2:*:*:*:*:*:*:*

OR cpe:/a:openldap:openldap:2.0.3:*:*:*:*:*:*:*

OR cpe:/a:openldap:openldap:2.0.4:*:*:*:*:*:*:*

OR cpe:/a:openldap:openldap:2.0.5:*:*:*:*:*:*:*

OR cpe:/a:openldap:openldap:2.0.6:*:*:*:*:*:*:*

OR cpe:/a:openldap:openldap:2.0.7:*:*:*:*:*:*:*

Configuration 2:

cpe:/o:debian:debian_linux:2.2:*:*:*:*:*:*:*

OR cpe:/o:mandrakesoft:mandrake_linux:7.1:*:*:*:*:*:*:*

OR cpe:/o:mandrakesoft:mandrake_linux:7.2:*:*:*:*:*:*:*

OR cpe:/o:mandrakesoft:mandrake_linux:8.0:*:*:*:*:*:*:*

OR cpe:/o:mandrakesoft:mandrake_linux_corporate_server:1.0.1:*:*:*:*:*:*:*

OR cpe:/o:redhat:linux:6.2:*:*:*:*:*:*:*

OR cpe:/o:redhat:linux:7.0:*:*:*:*:*:*:*

OR cpe:/o:redhat:linux:7.1:*:*:*:*:*:*:*

Configuration CCN 1:

cpe:/a:openldap:openldap:*:*:*:*:*:*:*:*

AND

cpe:/o:redhat:linux:6.2:*:*:*:*:*:*:*

OR cpe:/o:debian:debian_linux:2.2:*:*:*:*:*:*:*

OR cpe:/o:mandrakesoft:mandrake_linux:7.1:*:*:*:*:*:*:*

OR cpe:/o:redhat:linux:7:*:*:*:*:*:*:*

OR cpe:/o:mandrakesoft:mandrake_linux:7.2:*:*:*:*:*:*:*

OR cpe:/o:conectiva:linux:6.0:*:*:*:*:*:*:*

OR cpe:/o:mandrakesoft:mandrake_linux_corporate_server:1.0.1:*:*:*:*:*:*:*

OR cpe:/o:redhat:linux:7.1:*:*:*:*:*:*:*

OR cpe:/o:mandrakesoft:mandrake_linux:8.0:*:*:*:*:*:*:*

OR cpe:/o:conectiva:linux:4.1:*:*:*:*:*:*:*

OR cpe:/o:conectiva:linux:4.2:*:*:*:*:*:*:*

OR cpe:/o:conectiva:linux:5.0:*:*:*:*:*:*:*

OR cpe:/o:conectiva:linux:prg_graficos:*:*:*:*:*:*:*

OR cpe:/o:conectiva:linux:ecommerce:*:*:*:*:*:*:*

OR cpe:/o:conectiva:linux:5.1:*:*:*:*:*:*:*

OR cpe:/a:mandrakesoft:mandrake_single_network_firewall:7.2:*:*:*:*:*:*:*

OR cpe:/o:conectiva:linux:7.0:*:*:*:*:*:*:*

OR cpe:/o:redhat:linux:7.2:*:*:*:*:*:*:*

OR cpe:/o:redhat:linux:7.3:*:*:*:*:*:*:*

Denotes that component is vulnerable

Oval Definitions

Definition ID	Class	Title	Last Modified
oval:org.debian:def:68	V	remote DoS	2001-08-09