CVE-2015-6908

Published: Sep 11, 2015Modified: May 6, 2026

5.0

Vector

AV:N/AC:L/Au:N/C:N/I:N/A:P

Exploitability: 10.0 / Impact: 2.9

Source: NVD

Description

The ber_get_next function in libraries/liblber/io.c in OpenLDAP 2.4.42 and earlier allows remote attackers to cause a denial of service (reachable assertion and application crash) via crafted BER data, as demonstrated by an attack against slapd.

Affected (2)

Products: Openldap: Openldap · Apple: Mac Os X

1 product

1 product

Configuration A

1 vulnerable

Vulnerable Software	Affected Versions
Openldap Openldap	Up to 2.4.42

Configuration B

1 vulnerable

Vulnerable Software	Affected Versions
Apple Mac Os X	Up to 10.11.1

Related CWEs

CWE-20

Improper Input Validation

The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.

References (34)

http://lists.apple.com/archives/security-announce/2015/Dec/msg00005.html

Source: security@debian.org

http://lists.opensuse.org/opensuse-security-announce/2016-01/msg00031.html

Source: security@debian.org

http://lists.opensuse.org/opensuse-security-announce/2016-01/msg00032.html

Source: security@debian.org

http://lists.opensuse.org/opensuse-security-announce/2016-01/msg00037.html

Source: security@debian.org

http://lists.opensuse.org/opensuse-security-announce/2016-01/msg00039.html

Source: security@debian.org

http://lists.opensuse.org/opensuse-security-announce/2016-01/msg00040.html

Source: security@debian.org

http://rhn.redhat.com/errata/RHSA-2015-1840.html

Source: security@debian.org

http://www.debian.org/security/2015/dsa-3356

Source: security@debian.org

http://www.openldap.org/devel/gitweb.cgi?p=openldap.git%3Ba=commit%3Bh=6fe51a9ab04fd28bbc171da3cf12f1c1040d6629

Source: security@debian.org

http://www.openldap.org/its/index.cgi/Software%20Bugs?id=8240

Source: security@debian.org

ExploitVendor Advisory

http://www.oracle.com/technetwork/topics/security/linuxbulletinoct2015-2719645.html

Source: security@debian.org

http://www.oracle.com/technetwork/topics/security/ovmbulletinjul2016-3090546.html

Source: security@debian.org

http://www.security-assessment.com/files/documents/advisory/OpenLDAP-ber_get_next-Denial-of-Service.pdf

Source: security@debian.org

http://www.securityfocus.com/bid/76714

Source: security@debian.org

http://www.securitytracker.com/id/1033534

Source: security@debian.org

http://www.ubuntu.com/usn/USN-2742-1

Source: security@debian.org

https://support.apple.com/HT205637

Source: security@debian.org

http://lists.apple.com/archives/security-announce/2015/Dec/msg00005.html