CVE-2006-6493
published 2006-12-13CVE-2006-6493: Buffer overflow in the krbv4_ldap_auth function in servers/slapd/kerberos.c in OpenLDAP 2.4.3 and earlier, when OpenLDAP is compiled with the --enable-kbind…
PriorityP341medium5.1CVSS 2.0
AVNACHAuNCPIPAP
EXPLOIT
EPSS
9.19%
94.7th percentile
Buffer overflow in the krbv4_ldap_auth function in servers/slapd/kerberos.c in OpenLDAP 2.4.3 and earlier, when OpenLDAP is compiled with the --enable-kbind (Kerberos KBIND) option, allows remote attackers to execute arbitrary code via an LDAP bind request using the LDAP_AUTH_KRBV41 authentication method and long credential data.
Affected
119 ranges· showing 25
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| openldap | openldap | <= 2.4.3 | — |
| openldap | openldap | — | — |
| openldap | openldap | — | — |
| openldap | openldap | — | — |
| openldap | openldap | — | — |
| openldap | openldap | — | — |
| openldap | openldap | — | — |
| openldap | openldap | — | — |
| openldap | openldap | — | — |
| openldap | openldap | — | — |
| openldap | openldap | — | — |
| openldap | openldap | — | — |
| openldap | openldap | — | — |
| openldap | openldap | — | — |
| openldap | openldap | — | — |
| openldap | openldap | — | — |
| openldap | openldap | — | — |
| openldap | openldap | — | — |
| openldap | openldap | — | — |
| openldap | openldap | — | — |
| openldap | openldap | — | — |
| openldap | openldap | — | — |
| openldap | openldap | — | — |
| openldap | openldap | — | — |
| openldap | openldap | — | — |
CVSS provenance
nvdv2.05.1MEDIUMAV:N/AC:H/Au:N/C:P/I:P/A:P
vendor_redhat5.1MEDIUM
CVEs like this are exactly what “Exploited This Week” covers.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Red Hat
CVE-2006-6493: Buffer overflow in the krbv4_ldap_auth function in servers/slapd/kerberos
vendor_redhat·CVSS 5.1
CVE-2006-6493 [MEDIUM] CVE-2006-6493: Buffer overflow in the krbv4_ldap_auth function in servers/slapd/kerberos
Buffer overflow in the krbv4_ldap_auth function in servers/slapd/kerberos.c in OpenLDAP 2.4.3 and earlier, when OpenLDAP is compiled with the --enable-kbind (Kerberos KBIND) option, allows remote attackers to execute arbitrary code via an LDAP bind request using the LDAP_AUTH_KRBV41 authentication method and long credential data.
Statement: Not vulnerable. OpenLDAP as shipped with Red Hat Enterprise Linux 2.1, 3, and 4 does not support the LDAP_AUTH_KRBV41 authentication method.
GHSA
GHSA-33pq-qxh4-xwpc: Buffer overflow in the krbv4_ldap_auth function in servers/slapd/kerberos
ghsa_unreviewed·2022-05-01
CVE-2006-6493 [MEDIUM] GHSA-33pq-qxh4-xwpc: Buffer overflow in the krbv4_ldap_auth function in servers/slapd/kerberos
Buffer overflow in the krbv4_ldap_auth function in servers/slapd/kerberos.c in OpenLDAP 2.4.3 and earlier, when OpenLDAP is compiled with the --enable-kbind (Kerberos KBIND) option, allows remote attackers to execute arbitrary code via an LDAP bind request using the LDAP_AUTH_KRBV41 authentication method and long credential data.
No detection rules found.
No writeups or analysis indexed.
http://secunia.com/advisories/23334http://securityreason.com/securityalert/2023http://www.phreedom.org/solar/exploits/openldap-kbindhttp://www.securityfocus.com/archive/1/454181/30/0/threadedhttp://www.vupen.com/english/advisories/2006/4964http://secunia.com/advisories/23334http://securityreason.com/securityalert/2023http://www.phreedom.org/solar/exploits/openldap-kbindhttp://www.securityfocus.com/archive/1/454181/30/0/threadedhttp://www.vupen.com/english/advisories/2006/4964
2006-12-13
Published