CVE-2013-4449

Public on 2014-02-05
Modified on 2014-09-16
Description
The rwm overlay in OpenLDAP 2.4.23, 2.4.36, and earlier does not properly count references, which allows remote attackers to cause a denial of service (slapd crash) by unbinding immediately after a search request, which triggers rwm_conn_destroy to free the session context while it is being used by rwm_op_search.
Severity
Medium severity
Medium
See what this means
CVSS v3 Base Score
4.3
See breakdown

Affected Packages

Platform Package Release Date Advisory Status
Amazon Linux 1 openldap 2014-02-26 ALAS-2014-294 Fixed

CVSS Scores

Score Type Score Vector
Amazon Linux CVSSv2 4.3 AV:N/AC:M/Au:N/C:N/I:N/A:P
NVD CVSSv2 4.3 AV:N/AC:M/Au:N/C:N/I:N/A:P

References

FAQs regarding Amazon Linux ALAS/CVE Severity Red Hat: CVE-2013-4449 Mitre: CVE-2013-4449