[Date Prev][Date Next] [Chronological] [Thread] [Top]

Re: (ITS#5580) BER Decoding Remote DoS Vulnerability

Howard Chu wrote:
> zdi-disclosures@tippingpoint.com wrote:
>> Full_Name: Cameron Hotchkies
>> Version: 2.3.41
>> OS: Gentoo Linux
>> URL: ftp://ftp.openldap.org/incoming/
>> Submission from: (NULL) (
>> This vulnerability allows remote attackers to deny services on vulnerable
>> installations of OpenLDAP. Authentication is not required to exploit this
>> vulnerability.
> Thanks for the report, a fix is now in HEAD. Please test.

For future reference, it looks like this may have crept in in 2001, rev 

   -- Howard Chu
   CTO, Symas Corp.           http://www.symas.com
   Director, Highland Sun     http://highlandsun.com/hyc/
   Chief Architect, OpenLDAP  http://www.openldap.org/project/