Unscored severity · published Feb 26, 2014
CVE-2012-2134
The handle_connection_error function in ldap_helper.c in bind-dyndb-ldap before 1.1.0rc1 does not properly handle LDAP query errors, which allows remote attackers to cause a…
–
CVSS
2.3%
EPSS
No
On KEV
Description
The handle_connection_error function in ldap_helper.c in bind-dyndb-ldap before 1.1.0rc1 does not properly handle LDAP query errors, which allows remote attackers to cause a denial of service (infinite loop and named server hang) via a non-alphabet character in the base DN in an LDAP search DNS query.
Exploitation
Is it being used?
Exploit prediction (EPSS)2.3% · higher than 83% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
BI
Bind-dyndb-ldap · Martin Nagy
through 1.1.0; 0.1.0; 0.1.0; 0.2.0; 1.0.0; 1.0.0; +3 more · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2012-2134
CVE.org
https://www.cve.org/CVERecord?id=CVE-2012-2134
Patch
http://rhn.redhat.com/errata/RHSA-2012-0683.html
Vendor Advisory
http://secunia.com/advisories/48901
www.openwall.com
http://www.openwall.com/lists/oss-security/2012/04/24/15
www.osvdb.org
http://www.osvdb.org/81619
bugzilla.redhat.com
https://bugzilla.redhat.com/show_bug.cgi?id=815846
git.fedorahosted.org
https://git.fedorahosted.org/cgit/bind-dyndb-ldap.git/tree/NEWS
More from Bind-dyndb-ldap
–
CVE-2012-3429
The dns_to_ldap_dn_escape function in src/ldap_convert.c in bind-dyndb-ldap 1.1.0rc1 and earlier does not properly escape distinguished names (DN) for LDAP queries, which allows…