Vulnerabilities > CVE-2006-2754 - Remote Security vulnerability in OpenLDAP

047910
CVSS 5.0 - MEDIUM
Attack vector
NETWORK
Attack complexity
LOW
Privileges required
NONE
Confidentiality impact
NONE
Integrity impact
PARTIAL
Availability impact
NONE
network
low complexity
openldap
nessus
NVD
Published: 2006-06-01
Updated: 2018-10-18

Summary

Stack-based buffer overflow in st.c in slurpd for OpenLDAP before 2.3.22 might allow attackers to execute arbitrary code via a long hostname.

Vulnerable Configurations

Part Description Count
Application
Openldap
12

Nessus

  • NASL familyGentoo Local Security Checks
    NASL idGENTOO_GLSA-200606-17.NASL
    descriptionThe remote host is affected by the vulnerability described in GLSA-200606-17 (OpenLDAP: Buffer overflow) slurpd contains a buffer overflow when reading very long hostnames from the status file. Impact : By injecting an overly long hostname in the status file, an attacker could possibly cause the execution of arbitrary code with the permissions of the user running slurpd. Workaround : There is no known workaround at this time.
    last seen2020-06-01
    modified2020-06-02
    plugin id21710
    published2006-06-16
    reporterThis script is Copyright (C) 2006-2019 Tenable Network Security, Inc.
    sourcehttps://www.tenable.com/plugins/nessus/21710
    titleGLSA-200606-17 : OpenLDAP: Buffer overflow
  • NASL familyUbuntu Local Security Checks
    NASL idUBUNTU_USN-305-1.NASL
    descriptionWhen processing overly long host names in OpenLDAP
    last seen2020-06-01
    modified2020-06-02
    plugin id27880
    published2007-11-10
    reporterUbuntu Security Notice (C) 2007-2019 Canonical, Inc. / NASL script (C) 2018 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/27880
    titleUbuntu 5.04 / 5.10 / 6.06 LTS : openldap2, openldap2.2 vulnerability (USN-305-1)
  • NASL familyMandriva Local Security Checks
    NASL idMANDRAKE_MDKSA-2006-096.NASL
    descriptionA stack-based buffer overflow in st.c in slurpd for OpenLDAP might allow attackers to execute arbitrary code via a long hostname. Packages have been patched to correct this issue.
    last seen2020-06-01
    modified2020-06-02
    plugin id21668
    published2006-06-08
    reporterThis script is Copyright (C) 2006-2019 Tenable Network Security, Inc.
    sourcehttps://www.tenable.com/plugins/nessus/21668
    titleMandrake Linux Security Advisory : openldap (MDKSA-2006:096)

Statements

contributorMark J Cox
lastmodified2006-08-16
organizationRed Hat
statementThis issue is not exploitable as the status file is only written to and read by the slurpd process. Therefore this is not a vulnerability that affects Red Hat Enterprise Linux 2.1, 3, or 4.

References