CVE-2013-0288

Published: Mar 5, 2013Modified: Apr 29, 2026

6.8

Vector

AV:N/AC:M/Au:N/C:P/I:P/A:P

Exploitability: 8.6 / Impact: 6.4

Source: NVD

Description

nss-pam-ldapd before 0.7.18 and 0.8.x before 0.8.11 allows context-dependent attackers to cause a denial of service (application crash) and possibly execute arbitrary code by performing a name lookup on an application with a large number of open file descriptors, which triggers a stack-based buffer overflow related to incorrect use of the FD_SET macro.

Affected (52)

Products: Arthurdejong: Nss Pam Ldapd

1 product

Configuration A

11 vulnerable

Vulnerable Software	Affected Versions
Arthurdejong Nss Pam Ldapd	Version 0.8.0
Arthurdejong Nss Pam Ldapd	Version 0.8.10
Arthurdejong Nss Pam Ldapd	Version 0.8.1
Arthurdejong Nss Pam Ldapd	Version 0.8.2
Arthurdejong Nss Pam Ldapd	Version 0.8.3
Arthurdejong Nss Pam Ldapd	Version 0.8.4
Arthurdejong Nss Pam Ldapd	Version 0.8.5
Arthurdejong Nss Pam Ldapd	Version 0.8.6
Arthurdejong Nss Pam Ldapd	Version 0.8.7
Arthurdejong Nss Pam Ldapd	Version 0.8.8
Arthurdejong Nss Pam Ldapd	Version 0.8.9

Configuration B

41 vulnerable

Vulnerable Software	Affected Versions
Arthurdejong Nss Pam Ldapd	Up to 0.7.17
Arthurdejong Nss Pam Ldapd	Version 0.1
Arthurdejong Nss Pam Ldapd	Version 0.2.1
Arthurdejong Nss Pam Ldapd	Version 0.2
Arthurdejong Nss Pam Ldapd	Version 0.3
Arthurdejong Nss Pam Ldapd	Version 0.4.1
Arthurdejong Nss Pam Ldapd	Version 0.4
Arthurdejong Nss Pam Ldapd	Version 0.5
Arthurdejong Nss Pam Ldapd	Version 0.6.0
Arthurdejong Nss Pam Ldapd	Version 0.6.10
Arthurdejong Nss Pam Ldapd	Version 0.6.11
Arthurdejong Nss Pam Ldapd	Version 0.6.12
Arthurdejong Nss Pam Ldapd	Version 0.6.1
Arthurdejong Nss Pam Ldapd	Version 0.6.2
Arthurdejong Nss Pam Ldapd	Version 0.6.3
Arthurdejong Nss Pam Ldapd	Version 0.6.4
Arthurdejong Nss Pam Ldapd	Version 0.6.5
Arthurdejong Nss Pam Ldapd	Version 0.6.6
Arthurdejong Nss Pam Ldapd	Version 0.6.7.1
Arthurdejong Nss Pam Ldapd	Version 0.6.7.2
Arthurdejong Nss Pam Ldapd	Version 0.6.7
Arthurdejong Nss Pam Ldapd	Version 0.6.8
Arthurdejong Nss Pam Ldapd	Version 0.6.9
Arthurdejong Nss Pam Ldapd	Version 0.6
Arthurdejong Nss Pam Ldapd	Version 0.7.0
Arthurdejong Nss Pam Ldapd	Version 0.7.10
Arthurdejong Nss Pam Ldapd	Version 0.7.11
Arthurdejong Nss Pam Ldapd	Version 0.7.12
Arthurdejong Nss Pam Ldapd	Version 0.7.13
Arthurdejong Nss Pam Ldapd	Version 0.7.14
Arthurdejong Nss Pam Ldapd	Version 0.7.15
Arthurdejong Nss Pam Ldapd	Version 0.7.16
Arthurdejong Nss Pam Ldapd	Version 0.7.1
Arthurdejong Nss Pam Ldapd	Version 0.7.2
Arthurdejong Nss Pam Ldapd	Version 0.7.3
Arthurdejong Nss Pam Ldapd	Version 0.7.4
Arthurdejong Nss Pam Ldapd	Version 0.7.5
Arthurdejong Nss Pam Ldapd	Version 0.7.6
Arthurdejong Nss Pam Ldapd	Version 0.7.7
Arthurdejong Nss Pam Ldapd	Version 0.7.8
Arthurdejong Nss Pam Ldapd	Version 0.7.9

Related CWEs

Improper Restriction of Operations within the Bounds of a Memory Buffer

The product performs operations on a memory buffer, but it reads from or writes to a memory location outside the buffer's intended boundary. This may result in read or write operations on unexpected memory locations that could be linked to other variables, data structures, or internal program data.

References (36)

http://arthurdejong.org/git/nss-pam-ldapd/commit/?id=7867b93f9a7c76b96f1571cddc1de0811134bb81

Source: secalert@redhat.com

http://arthurdejong.org/git/nss-pam-ldapd/commit/?id=abf03bc54032beeff95b1b8634cc005137e11f32

Source: secalert@redhat.com

http://arthurdejong.org/git/nss-pam-ldapd/commit/?id=f266f05f20afe73e89c3946a7bd60bd7c5948e1b

Source: secalert@redhat.com

http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=690319

Source: secalert@redhat.com

http://lists.arthurdejong.org/nss-pam-ldapd-announce/2013/msg00001.html

Source: secalert@redhat.com

http://lists.fedoraproject.org/pipermail/package-announce/2013-February/099438.html

Source: secalert@redhat.com

http://lists.opensuse.org/opensuse-updates/2013-03/msg00087.html

Source: secalert@redhat.com

http://lists.opensuse.org/opensuse-updates/2013-03/msg00091.html

Source: secalert@redhat.com

http://rhn.redhat.com/errata/RHSA-2013-0590.html

Source: secalert@redhat.com

http://secunia.com/advisories/52212

Source: secalert@redhat.com

http://secunia.com/advisories/52242

Source: secalert@redhat.com

Vendor Advisory

http://www.debian.org/security/2012/dsa-2628

Source: secalert@redhat.com

http://www.mandriva.com/security/advisories?name=MDVSA-2013:106

Source: secalert@redhat.com

http://www.openwall.com/lists/oss-security/2013/02/18/2

Source: secalert@redhat.com

http://www.securityfocus.com/bid/58007

Source: secalert@redhat.com

https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2013-0288

Source: secalert@redhat.com

https://exchange.xforce.ibmcloud.com/vulnerabilities/82175

Source: secalert@redhat.com

https://wiki.mageia.org/en/Support/Advisories/MGASA-2013-0071

Source: secalert@redhat.com

http://arthurdejong.org/git/nss-pam-ldapd/commit/?id=7867b93f9a7c76b96f1571cddc1de0811134bb81

Source: af854a3a-2127-422b-91ae-364da2661108

http://arthurdejong.org/git/nss-pam-ldapd/commit/?id=abf03bc54032beeff95b1b8634cc005137e11f32

Source: af854a3a-2127-422b-91ae-364da2661108

http://arthurdejong.org/git/nss-pam-ldapd/commit/?id=f266f05f20afe73e89c3946a7bd60bd7c5948e1b

Source: af854a3a-2127-422b-91ae-364da2661108

http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=690319

Source: af854a3a-2127-422b-91ae-364da2661108

http://lists.arthurdejong.org/nss-pam-ldapd-announce/2013/msg00001.html

Source: af854a3a-2127-422b-91ae-364da2661108

http://lists.fedoraproject.org/pipermail/package-announce/2013-February/099438.html

Source: af854a3a-2127-422b-91ae-364da2661108

http://lists.opensuse.org/opensuse-updates/2013-03/msg00087.html

Source: af854a3a-2127-422b-91ae-364da2661108

http://lists.opensuse.org/opensuse-updates/2013-03/msg00091.html

Source: af854a3a-2127-422b-91ae-364da2661108

http://rhn.redhat.com/errata/RHSA-2013-0590.html

Source: af854a3a-2127-422b-91ae-364da2661108

http://secunia.com/advisories/52212

Source: af854a3a-2127-422b-91ae-364da2661108

http://secunia.com/advisories/52242

Source: af854a3a-2127-422b-91ae-364da2661108

Vendor Advisory

http://www.debian.org/security/2012/dsa-2628

Source: af854a3a-2127-422b-91ae-364da2661108

http://www.mandriva.com/security/advisories?name=MDVSA-2013:106

Source: af854a3a-2127-422b-91ae-364da2661108

http://www.openwall.com/lists/oss-security/2013/02/18/2

Source: af854a3a-2127-422b-91ae-364da2661108

http://www.securityfocus.com/bid/58007

Source: af854a3a-2127-422b-91ae-364da2661108

https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2013-0288

Source: af854a3a-2127-422b-91ae-364da2661108

https://exchange.xforce.ibmcloud.com/vulnerabilities/82175

Source: af854a3a-2127-422b-91ae-364da2661108

https://wiki.mageia.org/en/Support/Advisories/MGASA-2013-0071

Source: af854a3a-2127-422b-91ae-364da2661108

Timeline

No history available yet.