lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
Open Source and information security mailing list archives
| ||
|
Date: Thu Jun 29 01:03:41 2006 From: noreply at musecurity.com (noreply@...ecurity.com) Subject: [MU-200606-02] Apple Open Directory Pre-Authentication Denial of Service -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Apple Open Directory Pre-Authentication Denial of Service [MU-200606-02] June 27, 2006 http://labs.musecurity.com/advisories.html Affected Product/Versions: OSX 10.4.4 through 10.4.6 Product Overview: http://www.apple.com/server/macosx/features/opendirectory.html "Apple has made it easy to integrate Mac OS X and Mac OS X Server systems into virtually any managed network environment thanks to Open Directory, Apples standards-based directory and network authentication services architecture. Open Directory relies on powerful open source technologies, like Open LDAP and Kerberos, for seamless interoperability with other standards-based LDAP servers." Vulnerability Details: A denial of service condition exists in slapd (OpenLDAP-2.2.19) during the anonymous bind operation. By sending a malformed ldap-bind message, the slapd server can be forced to abort with the following assertion: /slapd/connection.c:1137: failed assertion `0' No credentials are required to trigger this denial of service. Vendor Response / Solution: All users of this service are recommended to upgrade to OSX 10.4.7 which fixes these problems. Hotfix solution to this advisory: http://docs.info.apple.com/article.html?artnum=61798 Mu Security would like to thank the Apple security team in advance for timely remediation of these vulnerabilities. History: 03/13/06 - First contact with vendor 04/07/06 - Vendor acknowledges vulnerability 06/27/06 - Advisory released Credit: This vulnerability was discovered by the Mu Security research team. http://labs.musecurity.com/pgpkey.txt Mu Security offers a new class of security analysis system, delivering a rigorous and streamlined methodology for verifying the robustness and security readiness of any IP-based product or application. Founded by the pioneers of intrusion detection and prevention technology, Mu Security is backed by preeminent venture capital firms that include Accel Partners, Benchmark Capital and DAG Ventures. The company is headquartered in Sunnyvale, CA. For more information, visit the companys website at http://www.musecurity.com. -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.2.2 (Darwin) iD8DBQFEorYcMl+docYeP+YRAvvoAJ41/zNqW86hsM3Nwe4VocGqXa7s1gCfXdzI 3N9yx/H/wcvzq49LLFvEZWQ= =tRGR -----END PGP SIGNATURE-----
Powered by blists - more mailing lists