This script is Copyright (C) 2008-2015 Tenable Network Security, Inc.
The remote Gentoo host is missing one or more security-related
The remote host is affected by the vulnerability described in GLSA-200803-28
(OpenLDAP: Denial of Service vulnerabilities)
The following errors have been discovered in OpenLDAP:
Tony Blake discovered an error which exists within the normalisation of
Thomas Sesselmann reported that, when running as a proxy-caching server
the 'add_filter_attrs()' function in servers/slapd/overlay/pcache.c
does not correctly NULL terminate 'new_attrs' (CVE-2007-5708).
A double-free bug exists in attrs_free() in the file
servers/slapd/back-bdb/modrdn.c, which was discovered by Jonathan
A remote attacker can cause a Denial of Serivce by sending a malformed
'objectClasses' attribute, and via unknown vectors that prevent the
'new_attrs' array from being NULL terminated, and via a modrdn
operation with a NOOP (LDAP_X_NO_OPERATION) control.
There is no known workaround at this time.
See also :
All OpenLDAP users should upgrade to the latest version:
# emerge --sync
# emerge --ask --oneshot --verbose '>=net-nds/openldap-2.3.41'
Risk factor :
High / CVSS Base Score : 7.1
Family: Gentoo Local Security Checks
Nessus Plugin ID: 31634 (gentoo_GLSA-200803-28.nasl)
CVE ID: CVE-2007-5707CVE-2007-5708CVE-2008-0658
The cookie settings on this website are set to 'allow all cookies' to give you the very best website experience. If you continue without changing these settings, you consent to this - but if you want, you can opt out of all cookies by clicking below.