远程主机似乎正在运行 OpenLDAP，这是一种开源 LDAP 目录实现。 

远程主机上安装的 OpenLDAP 版本无法处理畸形 SASL bind 请求。未经身份验证的攻击者可利用此问题导致受影响主机上的 LDAP 服务器崩溃。

リモートホストは、オープンソースのLDAPディレクトリ実装であるOpenLDAPを実行しているようです。 

リモートホストにインストールされているOpenLDAPのバージョンは、無効な形式のSASLバインドリクエストの処理に失敗します。認証されていない攻撃者がこの問題を利用して、影響を受けるホスト上のLDAPサーバーをクラッシュさせる可能性があります。

遠端主機似乎正在執行 OpenLDAP，這是一種開放原始碼 LDAP 目錄實作。 

遠端主機上安裝的 OpenLDAP 版本無法處理格式錯誤的 SASL bind 要求。未經驗證的攻擊者可利用此問題在受影響的主機上造成 LDAP 伺服器當機。

The remote host is affected by the vulnerability described in GLSA-200611-25 (OpenLDAP: Denial of Service vulnerability)

    Evgeny Legerov has discovered that the truncation of an incoming     authcid longer than 255 characters and ending with a space as the 255th     character will lead to an improperly computed name length. This will     trigger an assert in the libldap code.
  Impact :

    By sending a BIND request with a specially crafted authcid parameter to     an OpenLDAP service, a remote attacker can cause the service to crash.
  Workaround :

    There is no known workaround at this time.

OpenLDAP libldap's strval2strlen() function contained a bug when processing the authcid string of certain Bind Requests, which could allow attackers to cause an affected application (especially the OpenLDAP Server) to crash. (CVE-2006-5779)

An unspecified vulnerability in OpenLDAP allows remote attackers to cause a denial of service (daemon crash) via a certain combination of SASL Bind requests that triggers an assertion failure in libldap.

Packages have been patched to correct this issue.

OpenLDAP libldap's strval2strlen() function contained a bug when processing the authcid string of certain Bind Requests, which could allow attackers to cause an affected application (especially the OpenLDAP Server) to crash (CVE-2006-5779).

The remote host appears to be running OpenLDAP, an open source LDAP directory implementation. 

The version of OpenLDAP installed on the remote host fails to handle malformed SASL bind requests.  An unauthenticated attacker can leverage this issue to crash the LDAP server on the affected host.

Evgeny Legerov discovered that the OpenLDAP libraries did not correctly truncate authcid names. This situation would trigger an assert and abort the program using the libraries. A remote attacker could send specially crafted bind requests that would lead to an LDAP server denial of service.

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	名稱	產品	系列	已發布	已更新	嚴重性
23625	OpenLDAP SASL authcid 名称 BIND 请求 DoS	Nessus	Denial of Service	2006/11/7	2022/4/11	medium
23625	OpenLDAP SASL authcidの名前バインドリクエストのDoS	Nessus	Denial of Service	2006/11/7	2022/4/11	medium
23625	OpenLDAP SASL authcid 名稱 BIND 要求 DoS	Nessus	Denial of Service	2006/11/7	2022/4/11	medium
23747	GLSA-200611-25 : OpenLDAP: Denial of Service vulnerability	Nessus	Gentoo Local Security Checks	2006/11/30	2021/1/6	medium
41106	SuSE9 Security Update : openldap2-client (YOU Patch Number 11307)	Nessus	SuSE Local Security Checks	2009/9/24	2021/1/14	medium
24593	Mandrake Linux Security Advisory : openldap (MDKSA-2006:208)	Nessus	Mandriva Local Security Checks	2007/2/18	2021/1/6	medium
27364	openSUSE 10 Security Update : openldap2-client (openldap2-client-2282)	Nessus	SuSE Local Security Checks	2007/10/17	2021/1/14	medium
23625	OpenLDAP SASL authcid Name BIND Request DoS	Nessus	Denial of Service	2006/11/7	2022/4/11	medium
27967	Ubuntu 5.10 / 6.06 LTS / 6.10 : openldap2.2 vulnerability (USN-384-1)	Nessus	Ubuntu Local Security Checks	2007/11/10	2021/1/19	medium
29537	SuSE 10 Security Update : openldap2-client (ZYPP Patch Number 2291)	Nessus	SuSE Local Security Checks	2007/12/13	2021/1/14	medium

偵測

搜尋 Plugin

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium