CVE-2006-5779

high-risk
Published 2006-11-07

OpenLDAP before 2.3.29 allows remote attackers to cause a denial of service (daemon crash) via LDAP BIND requests with long authcid names, which triggers an assertion failure.

Do I need to act?

!
43.4% chance of exploitation in next 30 days
EPSS score — higher than 57% of all CVEs
-
Not on CISA KEV list
No confirmed active exploitation reported to CISA
?
Patch status unknown
Check vendor advisories for fix availability and mitigation guidance
7
CVSS 7.5/10 High
NETWORK / LOW complexity

Affected Products (4)

Affected Vendors

Openldap Canonical

References (46)

Broken Link http://gleg.net/downloads/VULNDISCO_META_FREE.tar.gz
Broken Link http://gleg.net/vulndisco_meta.shtml
Broken Link http://secunia.com/advisories/22750
Broken Link http://secunia.com/advisories/22953
Broken Link http://secunia.com/advisories/22996
Broken Link http://secunia.com/advisories/23125
Broken Link http://secunia.com/advisories/23133
Broken Link http://secunia.com/advisories/23152
Broken Link http://secunia.com/advisories/23170
Third Party Advisory http://security.gentoo.org/glsa/glsa-200611-25.xml
Broken Link http://securityreason.com/securityalert/1831
Broken Link http://securitytracker.com/id?1017166
Broken Link http://www.mandriva.com/security/advisories?name=MDKSA-2006:208
Broken Link http://www.novell.com/linux/security/advisories/2006_72_openldap2.html
Exploit http://www.openldap.org/its/index.cgi/Software%20Bugs?id=4740
Broken Link http://www.openpkg.org/security/advisories/OpenPKG-SA-2006.033-openldap.html
Broken Link http://www.securityfocus.com/archive/1/450728/100/0/threaded
Broken Link http://www.securityfocus.com/bid/20939
Broken Link http://www.trustix.org/errata/2006/0066/
Third Party Advisory http://www.ubuntu.com/usn/usn-384-1
and 26 more references
53
/ 100
high-risk
Severity 26/34 · High
Exploitability 17/34 · Moderate
Exposure 10/34 · Low