CVE-2011-1067
published 2011-02-23CVE-2011-1067: slapd (aka ns-slapd) in 389 Directory Server before 1.2.8.a2 does not properly manage the c_timelimit field of the connection table element, which allows…
PriorityP420medium5CVSS 2.0
AVNACLAuNCNINAP
EPSS
1.42%
70.0th percentile
slapd (aka ns-slapd) in 389 Directory Server before 1.2.8.a2 does not properly manage the c_timelimit field of the connection table element, which allows remote attackers to cause a denial of service (daemon outage) via Simple Paged Results connections, as demonstrated by using multiple processes to replay TCP sessions, a different vulnerability than CVE-2011-0019.
Affected
9 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| fedoraproject | 389_directory_server | <= 1.2.8 | — |
| fedoraproject | 389_directory_server | — | — |
| fedoraproject | 389_directory_server | — | — |
| fedoraproject | 389_directory_server | — | — |
| fedoraproject | 389_directory_server | — | — |
| fedoraproject | 389_directory_server | — | — |
| fedoraproject | 389_directory_server | — | — |
| fedoraproject | 389_directory_server | — | — |
| fedoraproject | 389_directory_server | — | — |
CVSS provenance
nvdv2.05.0MEDIUMAV:N/AC:L/Au:N/C:N/I:N/A:P
vendor_redhat7.5HIGH
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
GHSA-xc37-cv9h-f6mv: slapd (aka ns-slapd) in 389 Directory Server before 1
ghsa_unreviewed·2022-05-17·CVSS 7.5
CVE-2011-1067 [HIGH] CWE-20 GHSA-xc37-cv9h-f6mv: slapd (aka ns-slapd) in 389 Directory Server before 1
slapd (aka ns-slapd) in 389 Directory Server before 1.2.8.a2 does not properly manage the c_timelimit field of the connection table element, which allows remote attackers to cause a denial of service (daemon outage) via Simple Paged Results connections, as demonstrated by using multiple processes to replay TCP sessions, a different vulnerability than CVE-2011-0019.
Red Hat
Server: DoS via Simple Paged Results connections
vendor_redhat·2011-01-10·CVSS 7.5
CVE-2011-1067 [HIGH] Server: DoS via Simple Paged Results connections
Server: DoS via Simple Paged Results connections
slapd (aka ns-slapd) in 389 Directory Server before 1.2.8.a2 does not properly manage the c_timelimit field of the connection table element, which allows remote attackers to cause a denial of service (daemon outage) via Simple Paged Results connections, as demonstrated by using multiple processes to replay TCP sessions, a different vulnerability than CVE-2011-0019.
Statement: Not vulnerable. This issue did not affect Red Hat Directory Server 8 packages.
Package: Directory Server (Red Hat Directory Server 8) - Affected
No detection rules found.
No public exploits indexed.
Bugzilla
CVE-2011-1067 Directory Server: DoS via Simple Paged Results connections
bugzilla·2011-02-24·CVSS 7.5
CVE-2011-1067 [HIGH] CVE-2011-1067 Directory Server: DoS via Simple Paged Results connections
CVE-2011-1067 Directory Server: DoS via Simple Paged Results connections
Common Vulnerabilities and Exposures assigned an identifier CVE-2011-1067 to
the following vulnerability:
slapd (aka ns-slapd) in 389 Directory Server before 1.2.8.a2 does not
properly manage the c_timelimit field of the connection table element,
which allows remote attackers to cause a denial of service (daemon
outage) via Simple Paged Results connections, as demonstrated by using
multiple processes to replay TCP sessions, a different vulnerability
than CVE-2011-0019.
References:
[1] http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-1067
[2] http://directory.fedoraproject.org/wiki/Release_Notes
[3] https://bugzilla.redhat.com/show_bug.cgi?id=668619
Discussion:
Relevant git commit:
http://git.fedorahosted.or
Bugzilla
CVE-2011-1000 Telepathy-Gabble: Audio and video calls sniffing via crafted google:jingleinfo stanza
bugzilla·2011-02-20·CVSS 6.4
CVE-2011-1000 [MEDIUM] CVE-2011-1000 Telepathy-Gabble: Audio and video calls sniffing via crafted google:jingleinfo stanza
CVE-2011-1000 Telepathy-Gabble: Audio and video calls sniffing via crafted google:jingleinfo stanza
Common Vulnerabilities and Exposures assigned an identifier CVE-2011-1000 to
the following vulnerability:
jingle-factory.c in Telepathy Gabble 0.11 before 0.11.7, 0.10 before
0.10.5, and 0.8 before 0.8.15 allows remote attackers to sniff audio
and video calls via a crafted google:jingleinfo stanza that specifies
an alternate server for streamed media.
References:
[1] http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-1000
[2] http://www.openwall.com/lists/oss-security/2011/02/17/4
[3] http://www.openwall.com/lists/oss-security/2011/02/17/7
[4] https://bugs.freedesktop.org/show_bug.cgi?id=34048
[5] http://www.debian.org/security/2011/dsa-2169
[6] http://www.ubuntu.com/usn/USN-1067-1
[7
http://directory.fedoraproject.org/wiki/Release_Noteshttp://secunia.com/advisories/43566https://bugzilla.redhat.com/show_bug.cgi?id=668619https://exchange.xforce.ibmcloud.com/vulnerabilities/65769http://directory.fedoraproject.org/wiki/Release_Noteshttp://secunia.com/advisories/43566https://bugzilla.redhat.com/show_bug.cgi?id=668619https://exchange.xforce.ibmcloud.com/vulnerabilities/65769
2011-02-23
Published