CVE-2013-4485

389 Directory Server 1.2.11.15 (aka Red Hat Directory Server before 8.2.11-14) allows remote authenticated users to cause a denial of service (crash) via multiple @ characters in a GER attribute list in a search request.

CVSS v2.0 4.0 MEDIUM

4.0^/10

CVSS v2.0 : MEDIUM

Vector : AV:N/AC:L/Au:S/C:N/I:N/A:P

Exploitability : 8.0 / Impact : 2.9

Access Vector NETWORK

Access Complexity LOW

Authentication SINGLE

Confidentiality Impact NONE

Integrity Impact NONE

Availability Impact PARTIAL

References

Link	Resource
http://rhn.redhat.com/errata/RHSA-2013-1752.html	Vendor Advisory
http://rhn.redhat.com/errata/RHSA-2013-1753.html	Vendor Advisory
http://secunia.com/advisories/55765	Vendor Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:o:redhat:enterprise_linux:6.0:*:*:*:*:*:*:*

Configuration 2 (hide)

OR	cpe:2.3:a:fedoraproject:389_directory_server:1.2.11.15:::::::*
	cpe:2.3:a:redhat:directory_server::::::::
	cpe:2.3:a:redhat:directory_server:7.1:::::::*
	cpe:2.3:a:redhat:directory_server:8.0:::::::*
	cpe:2.3:a:redhat:directory_server:8.1:::::::*

History

No history.

Information

Published : 2013-11-23 11:55

Updated : 2019-04-22 17:48

NVD link : CVE-2013-4485

Mitre link : CVE-2013-4485

CVE.ORG link : CVE-2013-4485

JSON object : View

Products Affected

fedoraproject

389_directory_server

redhat

enterprise_linux
directory_server

CWE

CWE-20

Improper Input Validation

{"id": "CVE-2013-4485", "cveTags": [], "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 4.0, "accessVector": "NETWORK", "vectorString": "AV:N/AC:L/Au:S/C:N/I:N/A:P", "authentication": "SINGLE", "integrityImpact": "NONE", "accessComplexity": "LOW", "availabilityImpact": "PARTIAL", "confidentialityImpact": "NONE"}, "acInsufInfo": false, "impactScore": 2.9, "baseSeverity": "MEDIUM", "obtainAllPrivilege": false, "exploitabilityScore": 8.0, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}]}, "published": "2013-11-23T11:55:04.710", "references": [{"url": "http://rhn.redhat.com/errata/RHSA-2013-1752.html", "tags": ["Vendor Advisory"], "source": "secalert@redhat.com"}, {"url": "http://rhn.redhat.com/errata/RHSA-2013-1753.html", "tags": ["Vendor Advisory"], "source": "secalert@redhat.com"}, {"url": "http://secunia.com/advisories/55765", "tags": ["Vendor Advisory"], "source": "secalert@redhat.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-20"}]}], "descriptions": [{"lang": "en", "value": "389 Directory Server 1.2.11.15 (aka Red Hat Directory Server before 8.2.11-14) allows remote authenticated users to cause a denial of service (crash) via multiple @ characters in a GER attribute list in a search request."}, {"lang": "es", "value": "389 Directory Server 1.2.11.15 (tambi\u00e9n conocido como Red Hat Directory Server anterior a la versi\u00f3n 8.2.11-14) permite a usuarios remotos autenticados provocar una denegaci\u00f3n de servicio (ca\u00edda) a trav\u00e9s de m\u00faltiples caracteres @ en una lista de atributo GER de una petici\u00f3n de b\u00fasqueda."}], "lastModified": "2019-04-22T17:48:00.643", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:redhat:enterprise_linux:6.0:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "2F6AB192-9D7D-4A9A-8995-E53A9DE9EAFC"}], "operator": "OR"}]}, {"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:fedoraproject:389_directory_server:1.2.11.15:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "16C83007-E3C8-40D0-ADAE-E7EE87CCA464"}, {"criteria": "cpe:2.3:a:redhat:directory_server:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "D5481052-D318-4F67-9567-79157BC716D0", "versionEndIncluding": "8.2"}, {"criteria": "cpe:2.3:a:redhat:directory_server:7.1:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "ABADB3F7-AD65-4E62-BEA5-782539911B6B"}, {"criteria": "cpe:2.3:a:redhat:directory_server:8.0:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "5E190C97-A279-4EEE-B9C4-1EA888920F80"}, {"criteria": "cpe:2.3:a:redhat:directory_server:8.1:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "2D75336B-F1E7-4369-B11D-1B132CA45424"}], "operator": "OR"}]}], "sourceIdentifier": "secalert@redhat.com"}