cbcvebase.
CVE-2011-1206
published 2011-04-21

CVE-2011-1206: Stack-based buffer overflow in the server process in ibmslapd.exe in IBM Tivoli Directory Server (TDS) 5.2 before 5.2.0.5-TIV-ITDS-IF0010, 6.0 before 6.0.0.67…

PriorityP264critical10CVSS 2.0
AVNACLAuNCCICAC
EXPLOIT
EPSS
15.72%
96.5th percentile
Stack-based buffer overflow in the server process in ibmslapd.exe in IBM Tivoli Directory Server (TDS) 5.2 before 5.2.0.5-TIV-ITDS-IF0010, 6.0 before 6.0.0.67 (aka 6.0.0.8-TIV-ITDS-IF0009), 6.1 before 6.1.0.40 (aka 6.1.0.5-TIV-ITDS-IF0003), 6.2 before 6.2.0.16 (aka 6.2.0.3-TIV-ITDS-IF0002), and 6.3 before 6.3.0.3 (aka 6.3.0.0-TIV-ITDS-IF0003) allows remote attackers to execute arbitrary code via a crafted LDAP request. NOTE: some of these details are obtained from third party information.

Affected

84 ranges· showing 25
VendorProductVersion rangeFixed in
ibmtivoli_directory_server——
ibmtivoli_directory_server——
ibmtivoli_directory_server——
ibmtivoli_directory_server——
ibmtivoli_directory_server——
ibmtivoli_directory_server——
ibmtivoli_directory_server——
ibmtivoli_directory_server——
ibmtivoli_directory_server——
ibmtivoli_directory_server——
ibmtivoli_directory_server——
ibmtivoli_directory_server——
ibmtivoli_directory_server——
ibmtivoli_directory_server——
ibmtivoli_directory_server——
ibmtivoli_directory_server——
ibmtivoli_directory_server——
ibmtivoli_directory_server——
ibmtivoli_directory_server——
ibmtivoli_directory_server——
ibmtivoli_directory_server——
ibmtivoli_directory_server——
ibmtivoli_directory_server——
ibmtivoli_directory_server——
ibmtivoli_directory_server——

Detection & IOCsextracted from sources · hover to see the quote

processibmslapd.exe↗
portTCP 389↗
bytes↗
\x30\x18\x02\x01\x01\x60\x13\x02\x01\x03\x04\x00\xA3\x0C\x04\x08\x43\x52\x41\x4D\x2D\x4D\x44\x35\x04\x00
  • →Detect unauthenticated LDAP SASL CRAM-MD5 Bind Requests on TCP/389 where the credentials length field is set to 0xFFFFFFFF (oversized/malformed), indicating exploitation of the ber_get_int buffer allocation flaw. ↗
  • →Monitor ibmslapd.exe for unexpected child process creation or SYSTEM-level code execution, as successful exploitation runs arbitrary code under the SYSTEM user context. ↗
  • →Flag LDAP Bind Request packets (tag 0x60) containing the SASL mechanism string 'CRAM-MD5' (bytes 0x43 0x52 0x41 0x4D 0x2D 0x4D 0x44 0x35) followed by a credentials length of 0x84 0xFF 0xFF 0xFF 0xFF (BER long-form encoding of an abnormally large value). ↗
  • →Authentication is not required to exploit this vulnerability — alert on any CRAM-MD5 SASL bind attempt from external/untrusted sources to IBM TDS on TCP/389. ↗
  • ·The vulnerable process ibmslapd.exe listens on TCP/389 by default; confirm this default port is in use in your environment as it may be reconfigured. ↗
  • ·This vulnerability is Windows-platform specific; Linux/Unix deployments of IBM Tivoli Directory Server are not affected by this particular exploit path. ↗
  • ·The overflow is triggered via libibmldap.dll's handling of CRAM-MD5 packet data; ensure that DLL is also patched/updated alongside ibmslapd.exe. ↗
CVEs like this are exactly what “Exploited This Week” covers.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.