CVE-2008-2595

Related Files

oracleidir-dos.txt

Posted Jul 21, 2008

Authored by Joxean Koret

Oracle Internet Directory version 10.1.4 remote pre-authentication denial of service exploit.

tags | exploit, remote, denial of service

advisories | CVE-2008-2595

SHA-256 | 8d1454c1f63a29730308467b4cbabfa22ad6cd5aef0563cb61441a2c8e3c5904

Download | Favorite | View

iDEFENSE Security Advisory 2008-07-15.1

Posted Jul 16, 2008

Authored by iDefense Labs, Joxean Koret | Site idefense.com

iDefense Security Advisory 07.15.08 - Remote exploitation of a pre-authentication input validation vulnerability in Oracle Corp.'s Oracle Internet Directory allows an attacker to conduct a denial of service attack on a vulnerable host. Internet Directory consists of two processes. One process acts as a listener. It handles incoming connections and passes them off to the second process. The second process, which handles requests, contains the vulnerability. When processing a malformed LDAP request, it is possible to cause the handler to dereference a NULL pointer. This results in the process crashing. Future connection requests will be accepted by the listener process, and then immediately closed when it finds that there is no handler process running. iDefense confirmed the existence of this vulnerability in Oracle Internet Directory for Windows version 10.1.4.0.1 with the April 2007 CPU installed. Previous versions may also be affected.

tags | advisory, remote, denial of service

systems | windows

advisories | CVE-2008-2595

SHA-256 | b68c1567bcbb9c57e54d5c5d2a26fa9cc93258efcc805e6245e76fe2cfb9c7e1

Download | Favorite | View