The ber_get_next function in libraries/liblber/io.c in OpenLDAP 2.4.42 and earlier allows remote attackers to cause a denial of service (reachable assertion and application crash) via crafted BER data, as demonstrated by an attack against slapd.

The remote Redhat Enterprise Linux 4 host has one or more packages installed that are affected by a vulnerability that has been acknowledged by the vendor but will not be patched.

  - openldap: ber_get_next denial of service vulnerability (CVE-2015-6908)

Note that Nessus has not tested for this issue but has instead relied on the package manager's report that the package is installed.

The remote OracleVM system is missing necessary patches to address critical security updates :

  - CVE-2015-6908 openldap: ber_get_next denial of service     vulnerability (#1263170)

  - fix: syncprov psearch race condition (#999811)

  - fix: CVE-2013-4449 segfault on certain queries with rwm     overlay (#1064146)

  - fix: do not send IPv6 DNS queries when IPv6 is disabled     on the host (#812772)

  - fix: disable static libraries stripping (#684630)

  - fix: memory leaks in syncrepl and slap_sl_free (#741184)

  - new feature update: honor priority/weight with     ldap_domain2hostlist (#733435)

  - fix: initscript marked as %config incorrectly (#738768)

  - new feature: honor priority/weight with     ldap_domain2hostlist (#733435)

  - fix: strict aliasing warnings during package build     (#732381)

  - fix: OpenLDAP packages lack debug data (#684630)

  - doc: Document preferred use of TLS_CACERT instead of     TLS_CACERTDIR to specify Certificate Authorities     (#699652)

  - fix: libldap ignores a directory of CA certificates if     any of them can't be read (#609722)

  - fix: Migration: migrate_all_offline.sh can't handle     duplicate entries (#563148)

  - fix: Init script is working wrong if database recovery     is needed (#604092)

  - fix: CVE-2011-1024 ppolicy forwarded bind failure     messages cause success (#680486)

  - fix: slapd concurrent access to connections causes slapd     to silently die (#641953)

  - backport: ldap_init_fd API function

  - fix: ppolicy crash while replace-deleting userPassword     attribute (#665951)

  - fix: connection freeze when using TLS (#591419)

  - don't remove task twice during replication

  - fixed segfault issues in modrdn (#606375)

  - added patch handling null char in TLS to compat package     (#606375, patch backported by Jan Vcelak )

The remote host is running a version of Mac OS X version 10.11.x prior to 10.11.2 and is affected by multiple vulnerabilities in the following components :

 - apache_mod_php
 - AppSandbox
 - Bluetooth
 - CFNetwork HTTPProtocol
 - Compression
 - Configuration Profiles
 - CoreGraphics
 - CoreMedia Playback
 - Disk Images
 - EFI
 - File Bookmark
 - Hypervisor
 - iBooks
 - ImageIO
 - Intel Graphics Driver
 - IOAcceleratorFamily
 - IOHIDFamily
 - IOKit SCSI
 - IOThunderboltFamily
 - Kernel
 - kext tools
 - Keychain Access
 - libarchive
 - libc
 - libexpat
 - libxml2
 - OpenGL
 - OpenLDAP
 - OpenSSH
 - QuickLook
 - Sandbox
 - Security
 - System Integrity Protection

Note that successful exploitation of the most serious issues can result in arbitrary code execution.

This update fixes the following security issues :

  - CVE-2015-6908: The ber_get_next function allowed remote     attackers to cause a denial of service (reachable     assertion and application crash) via crafted BER data,     as demonstrated by an attack against slapd. (bsc#945582)

  - CVE-2015-4000: Fix weak Diffie-Hellman size     vulnerability. (bsc#937766)

It also fixes the following non-security bugs :

  - bsc#955210: Unresponsive LDAP host lookups in IPv6     environment

This update adds the following functionality :

  - fate#319300: SHA2 password hashing module that can be     loaded on-demand. 

This update was imported from the SUSE:SLE-12:Update update project.

This update fixes the following security issues :

  - CVE-2015-6908: The ber_get_next function allowed remote     attackers to cause a denial of service (reachable     assertion and application crash) via crafted BER data,     as demonstrated by an attack against slapd. (bsc#945582)

  - CVE-2015-4000: Fix weak Diffie-Hellman size     vulnerability. (bsc#937766)

It also fixes the following non-security bugs :

  - bsc#955210: Unresponsive LDAP host lookups in IPv6     environment

  - bsc#904028: Add missing dependency binutils used by     %pre.

This update fixes the following security issues :

  - CVE-2015-6908: The ber_get_next function allowed remote     attackers to cause a denial of service (reachable     assertion and application crash) via crafted BER data,     as demonstrated by an attack against slapd. (bsc#945582)

  - CVE-2015-4000: Fix weak Diffie-Hellman size     vulnerability. (bsc#937766)

It also fixes the following non-security bugs :

  - bsc#955210: Unresponsive LDAP host lookups in IPv6     environment

This update adds the following functionality :

  - fate#319300: SHA2 password hashing module that can be     loaded on-demand.

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update fixes the following security issue :

  - CVE-2015-6908. Passing a crafted packet to the function     ber_get_next(), an attacker may cause a remote denial of     service, crashing the OpenLDAP server (bsc#945582).

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote host is running a version of Mac OS X 10.9.5 or 10.10.5 that is missing Security Update 2015-005 or 2015-008. It is, therefore, affected by multiple vulnerabilities in the following components :

  - apache_mod_php
  - AppSandbox
  - Bluetooth
  - CFNetwork HTTPProtocol
  - Compression
  - Configuration Profiles
  - CoreGraphics
  - CoreMedia Playback
  - Disk Images
  - EFI
  - File Bookmark
  - Hypervisor
  - iBooks
  - ImageIO
  - Intel Graphics Driver
  - IOAcceleratorFamily
  - IOHIDFamily
  - IOKit SCSI
  - IOThunderboltFamily
  - Kernel
  - kext tools
  - Keychain Access
  - libarchive
  - libc
  - libexpat
  - libxml2
  - OpenGL
  - OpenLDAP
  - OpenSSH
  - QuickLook
  - Sandbox
  - Security
  - System Integrity Protection

Note that successful exploitation of the most serious issues can result in arbitrary code execution.

The remote host is running a version of Mac OS X that is 10.11.x prior to 10.11.2. It is, therefore, affected by multiple vulnerabilities in the following components :

  - apache_mod_php
  - AppSandbox
  - Bluetooth
  - CFNetwork HTTPProtocol
  - Compression
  - Configuration Profiles
  - CoreGraphics
  - CoreMedia Playback
  - Disk Images
  - EFI
  - File Bookmark
  - Hypervisor
  - iBooks
  - ImageIO
  - Intel Graphics Driver
  - IOAcceleratorFamily
  - IOHIDFamily
  - IOKit SCSI
  - IOThunderboltFamily
  - Kernel
  - kext tools
  - Keychain Access
  - libarchive
  - libc
  - libexpat
  - libxml2
  - OpenGL
  - OpenLDAP
  - OpenSSH
  - QuickLook
  - Sandbox
  - Security
  - System Integrity Protection

Note that successful exploitation of the most serious issues can result in arbitrary code execution.

Updated openldap packages that fix one security issue are now available for Red Hat Enterprise Linux 5, 6, and 7.

Red Hat Product Security has rated this update as having Important security impact. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available from the CVE link in the References section.

OpenLDAP is an open source suite of Lightweight Directory Access Protocol (LDAP) applications and development tools. LDAP is a set of protocols used to access and maintain distributed directory information services over an IP network. The openldap package contains configuration files, libraries, and documentation for OpenLDAP.

A flaw was found in the way the OpenLDAP server daemon (slapd) parsed certain Basic Encoding Rules (BER) data. A remote attacker could use this flaw to crash slapd via a specially crafted packet.
(CVE-2015-6908)

All openldap users are advised to upgrade to these updated packages, which contain a backported patch to correct this issue.

A flaw was found in the way the OpenLDAP server daemon (slapd) parsed certain Basic Encoding Rules (BER) data. A remote attacker could use this flaw to crash slapd via a specially crafted packet.
(CVE-2015-6908)

The remote OracleVM system is missing necessary patches to address critical security updates :

  - CVE-2015-6908 openldap: ber_get_next denial of service     vulnerability (#1263171)

  - fix: nslcd segfaults due to incorrect mutex     initialization (#1144294)

  - fix: Updating openldap deletes database if slapd.conf is     used (#1193519)

  - fix: ppc64: slaptest segfault in openldap-2.4.40     (#1202696)

  - fix: bring back accidentaly removed patch (#1147983)

  - rebase to 2.4.40 (#1147983)

  - fix: make /etc/openldap/check_password.conf readable by     ldap (#1155390)

  - revert previous patch (#1172296)

  - fix: crash in ldap_domain2hostlist when processing SRV     record (#1164369)

  - support TLS 1.1 and later (#1160467)

  - enhancement: add ppolicy-check-password (#1155390)

  - fix: prevent freed memory reuse (#1172296)

  - fix: provide a shim libldif.so (#1110382)

  - fix: remove correct tmp file when generating server cert     (#1102083)

  - remove unapplied patches

  - fix: TLS_REQCERT documentation in client manpage     (#1027796)

  - review %configure and remove nonexistent options

  - add another missing patch forgotten during the rebase

  - fix: enable dynamic linking - unresolved symbols in the     smbk5pwd module

  - add missing patches that were removed by mistake during     the rebase

  - rebase to 2.4.39 (#923680)

  + drop a lot of upstreamed patches, backport the rest

  + compile in mdb

  + remove automatic slapd.conf -> slapd-config conversion

  - fix: segfault on certain queries with rwm overlay     (#1003038)

  - fix: deadlock during SSL_ForceHandshake (#996373)

  + revert nss-handshake-threadsafe.patch

The remote Oracle Linux 5 / 6 / 7 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2015-1840 advisory.

    [2.3.43-29]
    - CVE-2015-6908 openldap: ber_get_next denial of service vulnerability (#1263170)

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Ubuntu 14.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-2742-1 advisory.

    Denis Andzakovic discovered that OpenLDAP incorrectly handled certain BER data. A remote attacker could     possibly use this issue to cause OpenLDAP to crash, resulting in a denial of service. (CVE-2015-6908)

    Dietrich Clauss discovered that the OpenLDAP package incorrectly shipped with a potentially unsafe default     access control configuration. Depending on how the database is configure, this may allow users to     impersonate others by modifying attributes such as their Unix user and group numbers. (CVE-2014-9713)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Denis Andzakovic discovered that OpenLDAP, a free implementation of the Lightweight Directory Access Protocol, does not properly handle BER data. An unauthenticated remote attacker can use this flaw to cause a denial of service (slapd daemon crash) via a specially crafted packet.

The Squeeze-LTS package has been prepared by Ryan Tandy.

NOTE: Tenable Network Security has extracted the preceding description block directly from the DLA security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Denis Andzakovic reports :

By sending a crafted packet, an attacker may cause the OpenLDAP server to reach an assert(9 9 statement, crashing the daemon.

Denis Andzakovic discovered that OpenLDAP, a free implementation of the Lightweight Directory Access Protocol, does not properly handle BER data. An unauthenticated remote attacker can use this flaw to cause a denial of service (slapd daemon crash) via a specially crafted packet.

ID	Name	Product	Family	Severity
198756	RHEL 4 : openldap (Unpatched Vulnerability)	Nessus	Red Hat Local Security Checks	medium
91749	OracleVM 3.2 : openldap (OVMSA-2016-0069)	Nessus	OracleVM Local Security Checks	medium
9325	Mac OS X 10.11.x < 10.11.2 Multiple Vulnerabilities	Nessus Network Monitor	Operating System Detection	critical
88535	openSUSE Security Update : openldap2 (openSUSE-2016-104) (Logjam)	Nessus	SuSE Local Security Checks	low
88534	openSUSE Security Update : openldap2 (openSUSE-2016-102) (Logjam)	Nessus	SuSE Local Security Checks	low
88176	SUSE SLED12 / SLES12 Security Update : openldap2 (SUSE-SU-2016:0224-1) (Logjam)	Nessus	SuSE Local Security Checks	low
88165	openSUSE Security Update : openldap2 (openSUSE-2016-92) (Logjam)	Nessus	SuSE Local Security Checks	low
87909	SUSE SLED11 / SLES11 Security Update : openldap2 (SUSE-SU-2016:0090-1)	Nessus	SuSE Local Security Checks	medium
87321	Mac OS X Multiple Vulnerabilities (Security Updates 2015-005 / 2015-008)	Nessus	MacOS X Local Security Checks	critical
87314	Mac OS X 10.11.x < 10.11.2 Multiple Vulnerabilities	Nessus	MacOS X Local Security Checks	critical
86515	CentOS 5 / 6 / 7 : openldap (CESA-2015:1840)	Nessus	CentOS Local Security Checks	medium
86355	Amazon Linux AMI : openldap / compat-openldap (ALAS-2015-599)	Nessus	Amazon Linux Local Security Checks	medium
86216	OracleVM 3.3 : openldap (OVMSA-2015-0123)	Nessus	OracleVM Local Security Checks	medium
86202	Scientific Linux Security Update : openldap on SL5.x, SL6.x, SL7.x i386/x86_64 (20150929)	Nessus	Scientific Linux Local Security Checks	medium
86200	RHEL 5 / 6 / 7 : openldap (RHSA-2015:1840)	Nessus	Red Hat Local Security Checks	medium
86199	Oracle Linux 5 / 6 / 7 : openldap (ELSA-2015-1840)	Nessus	Oracle Linux Local Security Checks	medium
85984	Ubuntu 14.04 LTS : OpenLDAP vulnerabilities (USN-2742-1)	Nessus	Ubuntu Local Security Checks	medium
85931	Debian DLA-309-1 : openldap security update	Nessus	Debian Local Security Checks	medium
85924	FreeBSD : openldap -- denial of service vulnerability (4910d161-58a4-11e5-9ad8-14dae9d210b8)	Nessus	FreeBSD Local Security Checks	medium
85912	Debian DSA-3356-1 : openldap - security update	Nessus	Debian Local Security Checks	medium

Detections

Analytics

CVE-2015-6908

medium

Tenable Plugins

medium

medium

critical

low

low

low

low

medium

critical

critical

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium