Summary
The host is running IBM Tivoli Directory Server and is prone to remote code execution vulnerability.
Impact
Successful exploitation could allow remote attackers to execute arbitrary code within the context of the affected application or retrieve potentially sensitive information.
Impact Level: Application
Solution
Apply patches
https://www-304.ibm.com/support/docview.wss?uid=swg24029672 https://www-304.ibm.com/support/docview.wss?uid=swg24029663 https://www-304.ibm.com/support/docview.wss?uid=swg24029661 https://www-304.ibm.com/support/docview.wss?uid=swg24029660
Insight
The flaw is caused by a stack overflow error in the 'ibmslapd.exe' component when allocating a buffer via the 'ber_get_int()' function within 'libibmldap.dll' while handling LDAP CRAM-MD5 packets, which could be exploited by remote unauthenticated attackers to execute arbitrary code with SYSTEM privileges.
Affected
IBM Tivoli Directory Server 5.2 before 5.2.0.5-TIV-ITDS-IF0010, 6.0 before 6.0.0.67 (6.0.0.8-TIV-ITDS-IF0009),
6.1 before 6.1.0.40 (6.1.0.5-TIV-ITDS-IF0003),
6.2 before 6.2.0.16 (6.2.0.3-TIV-ITDS-IF0002),
and 6.3 before 6.3.0.3
References
Severity
Classification
-
CVE CVE-2011-1206, CVE-2011-1820 -
CVSS Base Score: 10.0
AV:N/AC:L/Au:N/C:C/I:C/A:C
Related Vulnerabilities
- 3CTftpSvc TFTP Server Long Mode Buffer Overflow Vulnerability
- CCProxy CONNECTION Request Buffer Overflow Vulnerability
- Citrix Provisioning Services 'streamprocess.exe' Component Remote Code Execution Vulnerability
- Alpine tmail and dmail Buffer Overflow Vulnerabilities (Win)
- Blazevideo HDTV Player PLF File Buffer Overflow Vulnerability