{"containers": {"cna": {"affected": [{"product": "n/a", "vendor": "n/a", "versions": [{"status": "affected", "version": "n/a"}]}], "datePublic": "2015-09-09T00:00:00", "descriptions": [{"lang": "en", "value": "The ber_get_next function in libraries/liblber/io.c in OpenLDAP 2.4.42 and earlier allows remote attackers to cause a denial of service (reachable assertion and application crash) via crafted BER data, as demonstrated by an attack against slapd."}], "problemTypes": [{"descriptions": [{"description": "n/a", "lang": "en", "type": "text"}]}], "providerMetadata": {"dateUpdated": "2016-12-20T16:57:01", "orgId": "79363d38-fa19-49d1-9214-5f28da3f3ac5", "shortName": "debian"}, "references": [{"name": "76714", "tags": ["vdb-entry", "x_refsource_BID"], "url": "http://www.securityfocus.com/bid/76714"}, {"tags": ["x_refsource_CONFIRM"], "url": "http://www.oracle.com/technetwork/topics/security/ovmbulletinjul2016-3090546.html"}, {"tags": ["x_refsource_CONFIRM"], "url": "http://www.security-assessment.com/files/documents/advisory/OpenLDAP-ber_get_next-Denial-of-Service.pdf"}, {"tags": ["x_refsource_CONFIRM"], "url": "https://support.apple.com/HT205637"}, {"name": "openSUSE-SU-2016:0255", "tags": ["vendor-advisory", "x_refsource_SUSE"], "url": "http://lists.opensuse.org/opensuse-security-announce/2016-01/msg00037.html"}, {"name": "SUSE-SU-2016:0224", "tags": ["vendor-advisory", "x_refsource_SUSE"], "url": "http://lists.opensuse.org/opensuse-security-announce/2016-01/msg00031.html"}, {"tags": ["x_refsource_CONFIRM"], "url": "http://www.openldap.org/devel/gitweb.cgi?p=openldap.git%3Ba=commit%3Bh=6fe51a9ab04fd28bbc171da3cf12f1c1040d6629"}, {"name": "DSA-3356", "tags": ["vendor-advisory", "x_refsource_DEBIAN"], "url": "http://www.debian.org/security/2015/dsa-3356"}, {"name": "APPLE-SA-2015-12-08-3", "tags": ["vendor-advisory", "x_refsource_APPLE"], "url": "http://lists.apple.com/archives/security-announce/2015/Dec/msg00005.html"}, {"tags": ["x_refsource_CONFIRM"], "url": "http://www.oracle.com/technetwork/topics/security/linuxbulletinoct2015-2719645.html"}, {"name": "USN-2742-1", "tags": ["vendor-advisory", "x_refsource_UBUNTU"], "url": "http://www.ubuntu.com/usn/USN-2742-1"}, {"tags": ["x_refsource_CONFIRM"], "url": "http://www.openldap.org/its/index.cgi/Software%20Bugs?id=8240"}, {"name": "RHSA-2015:1840", "tags": ["vendor-advisory", "x_refsource_REDHAT"], "url": "http://rhn.redhat.com/errata/RHSA-2015-1840.html"}, {"name": "1033534", "tags": ["vdb-entry", "x_refsource_SECTRACK"], "url": "http://www.securitytracker.com/id/1033534"}, {"name": "openSUSE-SU-2016:0261", "tags": ["vendor-advisory", "x_refsource_SUSE"], "url": "http://lists.opensuse.org/opensuse-security-announce/2016-01/msg00039.html"}, {"name": "SUSE-SU-2016:0262", "tags": ["vendor-advisory", "x_refsource_SUSE"], "url": "http://lists.opensuse.org/opensuse-security-announce/2016-01/msg00040.html"}, {"name": "openSUSE-SU-2016:0226", "tags": ["vendor-advisory", "x_refsource_SUSE"], "url": "http://lists.opensuse.org/opensuse-security-announce/2016-01/msg00032.html"}], "x_legacyV4Record": {"CVE_data_meta": {"ASSIGNER": "[email protected]", "ID": "CVE-2015-6908", "STATE": "PUBLIC"}, "affects": {"vendor": {"vendor_data": [{"product": {"product_data": [{"product_name": "n/a", "version": {"version_data": [{"version_value": "n/a"}]}}]}, "vendor_name": "n/a"}]}}, "data_format": "MITRE", "data_type": "CVE", "data_version": "4.0", "description": {"description_data": [{"lang": "eng", "value": "The ber_get_next function in libraries/liblber/io.c in OpenLDAP 2.4.42 and earlier allows remote attackers to cause a denial of service (reachable assertion and application crash) via crafted BER data, as demonstrated by an attack against slapd."}]}, "problemtype": {"problemtype_data": [{"description": [{"lang": "eng", "value": "n/a"}]}]}, "references": {"reference_data": [{"name": "76714", "refsource": "BID", "url": "http://www.securityfocus.com/bid/76714"}, {"name": "http://www.oracle.com/technetwork/topics/security/ovmbulletinjul2016-3090546.html", "refsource": "CONFIRM", "url": "http://www.oracle.com/technetwork/topics/security/ovmbulletinjul2016-3090546.html"}, {"name": "http://www.security-assessment.com/files/documents/advisory/OpenLDAP-ber_get_next-Denial-of-Service.pdf", "refsource": "CONFIRM", "url": "http://www.security-assessment.com/files/documents/advisory/OpenLDAP-ber_get_next-Denial-of-Service.pdf"}, {"name": "https://support.apple.com/HT205637", "refsource": "CONFIRM", "url": "https://support.apple.com/HT205637"}, {"name": "openSUSE-SU-2016:0255", "refsource": "SUSE", "url": "http://lists.opensuse.org/opensuse-security-announce/2016-01/msg00037.html"}, {"name": "SUSE-SU-2016:0224", "refsource": "SUSE", "url": "http://lists.opensuse.org/opensuse-security-announce/2016-01/msg00031.html"}, {"name": "http://www.openldap.org/devel/gitweb.cgi?p=openldap.git;a=commit;h=6fe51a9ab04fd28bbc171da3cf12f1c1040d6629", "refsource": "CONFIRM", "url": "http://www.openldap.org/devel/gitweb.cgi?p=openldap.git;a=commit;h=6fe51a9ab04fd28bbc171da3cf12f1c1040d6629"}, {"name": "DSA-3356", "refsource": "DEBIAN", "url": "http://www.debian.org/security/2015/dsa-3356"}, {"name": "APPLE-SA-2015-12-08-3", "refsource": "APPLE", "url": "http://lists.apple.com/archives/security-announce/2015/Dec/msg00005.html"}, {"name": "http://www.oracle.com/technetwork/topics/security/linuxbulletinoct2015-2719645.html", "refsource": "CONFIRM", "url": "http://www.oracle.com/technetwork/topics/security/linuxbulletinoct2015-2719645.html"}, {"name": "USN-2742-1", "refsource": "UBUNTU", "url": "http://www.ubuntu.com/usn/USN-2742-1"}, {"name": "http://www.openldap.org/its/index.cgi/Software%20Bugs?id=8240", "refsource": "CONFIRM", "url": "http://www.openldap.org/its/index.cgi/Software%20Bugs?id=8240"}, {"name": "RHSA-2015:1840", "refsource": "REDHAT", "url": "http://rhn.redhat.com/errata/RHSA-2015-1840.html"}, {"name": "1033534", "refsource": "SECTRACK", "url": "http://www.securitytracker.com/id/1033534"}, {"name": "openSUSE-SU-2016:0261", "refsource": "SUSE", "url": "http://lists.opensuse.org/opensuse-security-announce/2016-01/msg00039.html"}, {"name": "SUSE-SU-2016:0262", "refsource": "SUSE", "url": "http://lists.opensuse.org/opensuse-security-announce/2016-01/msg00040.html"}, {"name": "openSUSE-SU-2016:0226", "refsource": "SUSE", "url": "http://lists.opensuse.org/opensuse-security-announce/2016-01/msg00032.html"}]}}}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-06T07:36:34.937Z"}, "title": "CVE Program Container", "references": [{"name": "76714", "tags": ["vdb-entry", "x_refsource_BID", "x_transferred"], "url": "http://www.securityfocus.com/bid/76714"}, {"tags": ["x_refsource_CONFIRM", "x_transferred"], "url": "http://www.oracle.com/technetwork/topics/security/ovmbulletinjul2016-3090546.html"}, {"tags": ["x_refsource_CONFIRM", "x_transferred"], "url": "http://www.security-assessment.com/files/documents/advisory/OpenLDAP-ber_get_next-Denial-of-Service.pdf"}, {"tags": ["x_refsource_CONFIRM", "x_transferred"], "url": "https://support.apple.com/HT205637"}, {"name": "openSUSE-SU-2016:0255", "tags": ["vendor-advisory", "x_refsource_SUSE", "x_transferred"], "url": "http://lists.opensuse.org/opensuse-security-announce/2016-01/msg00037.html"}, {"name": "SUSE-SU-2016:0224", "tags": ["vendor-advisory", "x_refsource_SUSE", "x_transferred"], "url": "http://lists.opensuse.org/opensuse-security-announce/2016-01/msg00031.html"}, {"tags": ["x_refsource_CONFIRM", "x_transferred"], "url": "http://www.openldap.org/devel/gitweb.cgi?p=openldap.git%3Ba=commit%3Bh=6fe51a9ab04fd28bbc171da3cf12f1c1040d6629"}, {"name": "DSA-3356", "tags": ["vendor-advisory", "x_refsource_DEBIAN", "x_transferred"], "url": "http://www.debian.org/security/2015/dsa-3356"}, {"name": "APPLE-SA-2015-12-08-3", "tags": ["vendor-advisory", "x_refsource_APPLE", "x_transferred"], "url": "http://lists.apple.com/archives/security-announce/2015/Dec/msg00005.html"}, {"tags": ["x_refsource_CONFIRM", "x_transferred"], "url": "http://www.oracle.com/technetwork/topics/security/linuxbulletinoct2015-2719645.html"}, {"name": "USN-2742-1", "tags": ["vendor-advisory", "x_refsource_UBUNTU", "x_transferred"], "url": "http://www.ubuntu.com/usn/USN-2742-1"}, {"tags": ["x_refsource_CONFIRM", "x_transferred"], "url": "http://www.openldap.org/its/index.cgi/Software%20Bugs?id=8240"}, {"name": "RHSA-2015:1840", "tags": ["vendor-advisory", "x_refsource_REDHAT", "x_transferred"], "url": "http://rhn.redhat.com/errata/RHSA-2015-1840.html"}, {"name": "1033534", "tags": ["vdb-entry", "x_refsource_SECTRACK", "x_transferred"], "url": "http://www.securitytracker.com/id/1033534"}, {"name": "openSUSE-SU-2016:0261", "tags": ["vendor-advisory", "x_refsource_SUSE", "x_transferred"], "url": "http://lists.opensuse.org/opensuse-security-announce/2016-01/msg00039.html"}, {"name": "SUSE-SU-2016:0262", "tags": ["vendor-advisory", "x_refsource_SUSE", "x_transferred"], "url": "http://lists.opensuse.org/opensuse-security-announce/2016-01/msg00040.html"}, {"name": "openSUSE-SU-2016:0226", "tags": ["vendor-advisory", "x_refsource_SUSE", "x_transferred"], "url": "http://lists.opensuse.org/opensuse-security-announce/2016-01/msg00032.html"}]}]}, "cveMetadata": {"assignerOrgId": "79363d38-fa19-49d1-9214-5f28da3f3ac5", "assignerShortName": "debian", "cveId": "CVE-2015-6908", "datePublished": "2015-09-11T16:00:00", "dateReserved": "2015-09-11T00:00:00", "dateUpdated": "2024-08-06T07:36:34.937Z", "state": "PUBLISHED"}, "dataType": "CVE_RECORD", "dataVersion": "5.1"}

{}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:openldap:openldap:*:*:*:*:*:*:*:*", "matchCriteriaId": "90EB80C7-5A71-405D-BB93-BFA065F12487", "versionEndIncluding": "2.4.42", "vulnerable": true}], "negate": false, "operator": "OR"}]}, {"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:apple:mac_os_x:*:*:*:*:*:*:*:*", "matchCriteriaId": "767D7ECF-24C5-4605-9368-5A41456A475E", "versionEndIncluding": "10.11.1", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "descriptions": [{"lang": "en", "value": "The ber_get_next function in libraries/liblber/io.c in OpenLDAP 2.4.42 and earlier allows remote attackers to cause a denial of service (reachable assertion and application crash) via crafted BER data, as demonstrated by an attack against slapd."}, {"lang": "es", "value": "Vulnerabilidad en la funci\u00f3n ber_get_next en libraries/liblber/io.c en OpenLDAP 2.4.42 y versiones anteriores, permite a atacantes remotos causar una denegaci\u00f3n de servicio (aserci\u00f3n accesible y ca\u00edda de la aplicaci\u00f3n) a trav\u00e9s de datos BER manipulados, seg\u00fan lo demostrado por un ataque contra slapd."}], "id": "CVE-2015-6908", "lastModified": "2024-11-21T02:35:50.517", "metrics": {"cvssMetricV2": [{"acInsufInfo": false, "baseSeverity": "MEDIUM", "cvssData": {"accessComplexity": "LOW", "accessVector": "NETWORK", "authentication": "NONE", "availabilityImpact": "PARTIAL", "baseScore": 5.0, "confidentialityImpact": "NONE", "integrityImpact": "NONE", "vectorString": "AV:N/AC:L/Au:N/C:N/I:N/A:P", "version": "2.0"}, "exploitabilityScore": 10.0, "impactScore": 2.9, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "[email protected]", "type": "Primary", "userInteractionRequired": false}]}, "published": "2015-09-11T16:59:12.800", "references": [{"source": "[email protected]", "url": "http://lists.apple.com/archives/security-announce/2015/Dec/msg00005.html"}, {"source": "[email protected]", "url": "http://lists.opensuse.org/opensuse-security-announce/2016-01/msg00031.html"}, {"source": "[email protected]", "url": "http://lists.opensuse.org/opensuse-security-announce/2016-01/msg00032.html"}, {"source": "[email protected]", "url": "http://lists.opensuse.org/opensuse-security-announce/2016-01/msg00037.html"}, {"source": "[email protected]", "url": "http://lists.opensuse.org/opensuse-security-announce/2016-01/msg00039.html"}, {"source": "[email protected]", "url": "http://lists.opensuse.org/opensuse-security-announce/2016-01/msg00040.html"}, {"source": "[email protected]", "url": "http://rhn.redhat.com/errata/RHSA-2015-1840.html"}, {"source": "[email protected]", "url": "http://www.debian.org/security/2015/dsa-3356"}, {"source": "[email protected]", "url": "http://www.openldap.org/devel/gitweb.cgi?p=openldap.git%3Ba=commit%3Bh=6fe51a9ab04fd28bbc171da3cf12f1c1040d6629"}, {"source": "[email protected]", "tags": ["Exploit", "Vendor Advisory"], "url": "http://www.openldap.org/its/index.cgi/Software%20Bugs?id=8240"}, {"source": "[email protected]", "url": "http://www.oracle.com/technetwork/topics/security/linuxbulletinoct2015-2719645.html"}, {"source": "[email protected]", "url": "http://www.oracle.com/technetwork/topics/security/ovmbulletinjul2016-3090546.html"}, {"source": "[email protected]", "url": "http://www.security-assessment.com/files/documents/advisory/OpenLDAP-ber_get_next-Denial-of-Service.pdf"}, {"source": "[email protected]", "url": "http://www.securityfocus.com/bid/76714"}, {"source": "[email protected]", "url": "http://www.securitytracker.com/id/1033534"}, {"source": "[email protected]", "url": "http://www.ubuntu.com/usn/USN-2742-1"}, {"source": "[email protected]", "url": "https://support.apple.com/HT205637"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "http://lists.apple.com/archives/security-announce/2015/Dec/msg00005.html"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "http://lists.opensuse.org/opensuse-security-announce/2016-01/msg00031.html"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "http://lists.opensuse.org/opensuse-security-announce/2016-01/msg00032.html"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "http://lists.opensuse.org/opensuse-security-announce/2016-01/msg00037.html"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "http://lists.opensuse.org/opensuse-security-announce/2016-01/msg00039.html"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "http://lists.opensuse.org/opensuse-security-announce/2016-01/msg00040.html"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "http://rhn.redhat.com/errata/RHSA-2015-1840.html"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "http://www.debian.org/security/2015/dsa-3356"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "http://www.openldap.org/devel/gitweb.cgi?p=openldap.git%3Ba=commit%3Bh=6fe51a9ab04fd28bbc171da3cf12f1c1040d6629"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Exploit", "Vendor Advisory"], "url": "http://www.openldap.org/its/index.cgi/Software%20Bugs?id=8240"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "http://www.oracle.com/technetwork/topics/security/linuxbulletinoct2015-2719645.html"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "http://www.oracle.com/technetwork/topics/security/ovmbulletinjul2016-3090546.html"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "http://www.security-assessment.com/files/documents/advisory/OpenLDAP-ber_get_next-Denial-of-Service.pdf"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "http://www.securityfocus.com/bid/76714"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "http://www.securitytracker.com/id/1033534"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "http://www.ubuntu.com/usn/USN-2742-1"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "https://support.apple.com/HT205637"}], "sourceIdentifier": "[email protected]", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-20"}], "source": "[email protected]", "type": "Primary"}]}

{"affected_release": [{"advisory": "RHSA-2015:1840", "cpe": "cpe:/o:redhat:enterprise_linux:5", "package": "openldap-0:2.3.43-29.el5_11", "product_name": "Red Hat Enterprise Linux 5", "release_date": "2015-09-29T00:00:00Z"}, {"advisory": "RHSA-2015:1840", "cpe": "cpe:/o:redhat:enterprise_linux:6", "package": "openldap-0:2.4.40-6.el6_7", "product_name": "Red Hat Enterprise Linux 6", "release_date": "2015-09-29T00:00:00Z"}, {"advisory": "RHSA-2015:1840", "cpe": "cpe:/o:redhat:enterprise_linux:7", "package": "openldap-0:2.4.39-7.ael7b_1", "product_name": "Red Hat Enterprise Linux 7", "release_date": "2015-09-29T00:00:00Z"}], "bugzilla": {"description": "openldap: ber_get_next denial of service vulnerability", "id": "1262393", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1262393"}, "csaw": false, "cvss": {"cvss_base_score": "5.0", "cvss_scoring_vector": "AV:N/AC:L/Au:N/C:N/I:N/A:P", "status": "verified"}, "cwe": "CWE-20", "details": ["The ber_get_next function in libraries/liblber/io.c in OpenLDAP 2.4.42 and earlier allows remote attackers to cause a denial of service (reachable assertion and application crash) via crafted BER data, as demonstrated by an attack against slapd.", "A flaw was found in the way the OpenLDAP server daemon (slapd) parsed certain Basic Encoding Rules (BER) data. A remote attacker could use this flaw to crash slapd via a specially crafted packet."], "name": "CVE-2015-6908", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:4", "fix_state": "Will not fix", "package_name": "openldap", "product_name": "Red Hat Enterprise Linux 4"}], "public_date": "2015-09-09T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2015-6908\nhttps://nvd.nist.gov/vuln/detail/CVE-2015-6908"], "threat_severity": "Important"}