IM
IronMonkey Threat Research

CVE-2020-36224 HIGH

Published: 2021-01-26 | Last Modified: 2024-11-21 | Status: Modified

Description

A flaw was discovered in OpenLDAP before 2.4.57 leading to an invalid pointer free and slapd crash in the saslAuthzTo processing, resulting in denial of service.

Additional Descriptions (1)

Se detectó un fallo en OpenLDAP versiones anteriores a 2.4.57, conllevando a la liberación de un puntero no válido y un bloqueo de slapd en el procesamiento saslAuthzTo, resultando en una denegación de servicio

CVSS Metrics

Base Score: 7.5 (HIGH)

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Attack VectorNETWORK
Attack ComplexityLOW
Privileges RequiredNONE
User InteractionNONE
ScopeUNCHANGED
Confidentiality ImpactNONE
Integrity ImpactNONE
Availability ImpactHIGH

Source: [email protected]

Type: Primary

Exploitability Score: 3.9

Impact Score: 3.6

Base Score: 5.0 (MEDIUM)

AV:N/AC:L/Au:N/C:N/I:N/A:P

Access VectorNETWORK
Access ComplexityLOW
AuthenticationNONE
Confidentiality ImpactNONE
Integrity ImpactNONE
Availability ImpactPARTIAL

Source: [email protected]

Type: Primary

Exploitability Score: 10.0

Impact Score: 2.9

Weaknesses

Source Type Description
[email protected] Primary
en CWE-763

Affected Products

Vendor Product Version Update Type
openldap openldap * <built-in method update of dict object at 0x7fd36945e880> Application
debian debian_linux 9.0 <built-in method update of dict object at 0x7fd36945cec0> Operating System
debian debian_linux 10.0 <built-in method update of dict object at 0x7fd36945cd00> Operating System
apple mac_os_x * <built-in method update of dict object at 0x7fd2dbe97f40> Operating System
apple mac_os_x 10.14.6 <built-in method update of dict object at 0x7fd36945cc40> Operating System
apple mac_os_x 10.14.6 <built-in method update of dict object at 0x7fd36945f540> Operating System
apple mac_os_x 10.14.6 <built-in method update of dict object at 0x7fd36945da80> Operating System
apple mac_os_x 10.14.6 <built-in method update of dict object at 0x7fd3842ba140> Operating System
apple mac_os_x 10.14.6 <built-in method update of dict object at 0x7fd36945c0c0> Operating System
apple mac_os_x 10.14.6 <built-in method update of dict object at 0x7fd36945f300> Operating System
apple mac_os_x 10.14.6 <built-in method update of dict object at 0x7fd36945e180> Operating System
apple mac_os_x 10.14.6 <built-in method update of dict object at 0x7fd36945c5c0> Operating System
apple mac_os_x 10.14.6 <built-in method update of dict object at 0x7fd2dbd9fa80> Operating System
apple mac_os_x 10.14.6 <built-in method update of dict object at 0x7fd3401e6740> Operating System
apple mac_os_x 10.14.6 <built-in method update of dict object at 0x7fd2dbd9f380> Operating System
apple mac_os_x 10.14.6 <built-in method update of dict object at 0x7fd2dbd9c6c0> Operating System
apple mac_os_x 10.14.6 <built-in method update of dict object at 0x7fd36945d240> Operating System
apple mac_os_x 10.14.6 <built-in method update of dict object at 0x7fd36a000200> Operating System
apple mac_os_x 10.14.6 <built-in method update of dict object at 0x7fd36945eb80> Operating System
apple mac_os_x 10.14.6 <built-in method update of dict object at 0x7fd2dbd9cd40> Operating System
apple mac_os_x 10.14.6 <built-in method update of dict object at 0x7fd3842b8540> Operating System
apple macos * <built-in method update of dict object at 0x7fd36945cb80> Operating System

Affected Configurations

Operator: OR

Vulnerable CPE
Yes cpe:2.3:a:openldap:openldap:*:*:*:*:*:*:*:*

Operator: OR

Vulnerable CPE
Yes cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:*
Yes cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:*

Operator: OR

Vulnerable CPE
Yes cpe:2.3:o:apple:mac_os_x:*:*:*:*:*:*:*:*
Yes cpe:2.3:o:apple:mac_os_x:10.14.6:-:*:*:*:*:*:*
Yes cpe:2.3:o:apple:mac_os_x:10.14.6:security_update_2019-004:*:*:*:*:*:*
Yes cpe:2.3:o:apple:mac_os_x:10.14.6:security_update_2019-005:*:*:*:*:*:*
Yes cpe:2.3:o:apple:mac_os_x:10.14.6:security_update_2019-006:*:*:*:*:*:*
Yes cpe:2.3:o:apple:mac_os_x:10.14.6:security_update_2019-007:*:*:*:*:*:*
Yes cpe:2.3:o:apple:mac_os_x:10.14.6:security_update_2020-001:*:*:*:*:*:*
Yes cpe:2.3:o:apple:mac_os_x:10.14.6:security_update_2020-002:*:*:*:*:*:*
Yes cpe:2.3:o:apple:mac_os_x:10.14.6:security_update_2020-003:*:*:*:*:*:*
Yes cpe:2.3:o:apple:mac_os_x:10.14.6:security_update_2020-004:*:*:*:*:*:*
Yes cpe:2.3:o:apple:mac_os_x:10.14.6:security_update_2020-005:*:*:*:*:*:*
Yes cpe:2.3:o:apple:mac_os_x:10.14.6:security_update_2020-006:*:*:*:*:*:*
Yes cpe:2.3:o:apple:mac_os_x:10.14.6:security_update_2020-007:*:*:*:*:*:*
Yes cpe:2.3:o:apple:mac_os_x:10.14.6:security_update_2021-001:*:*:*:*:*:*
Yes cpe:2.3:o:apple:mac_os_x:10.14.6:security_update_2021-002:*:*:*:*:*:*
Yes cpe:2.3:o:apple:mac_os_x:10.14.6:security_update_2021-003:*:*:*:*:*:*
Yes cpe:2.3:o:apple:mac_os_x:10.14.6:supplemental_update:*:*:*:*:*:*
Yes cpe:2.3:o:apple:mac_os_x:10.14.6:supplemental_update_2:*:*:*:*:*:*
Yes cpe:2.3:o:apple:macos:*:*:*:*:*:*:*:*

References