// For flags

CVE-2011-1206

IBM Tivoli Directory Server ibmslapd.exe SASL Bind Request Remote Code Execution Vulnerability

Severity Score

10.0
*CVSS v2

Exploit Likelihood

*EPSS

Affected Versions

*CPE

Public Exploits

1
*Multiple Sources

Exploited in Wild

-
*KEV

Decision

-
*SSVC
Descriptions

Stack-based buffer overflow in the server process in ibmslapd.exe in IBM Tivoli Directory Server (TDS) 5.2 before 5.2.0.5-TIV-ITDS-IF0010, 6.0 before 6.0.0.67 (aka 6.0.0.8-TIV-ITDS-IF0009), 6.1 before 6.1.0.40 (aka 6.1.0.5-TIV-ITDS-IF0003), 6.2 before 6.2.0.16 (aka 6.2.0.3-TIV-ITDS-IF0002), and 6.3 before 6.3.0.3 (aka 6.3.0.0-TIV-ITDS-IF0003) allows remote attackers to execute arbitrary code via a crafted LDAP request. NOTE: some of these details are obtained from third party information.

Desbordamiento de búfer basado en pila en el proceso de servidor en ibmslapd.exe en IBM Tivoli Directory Server (TDS) v5.2 anterior a v5.2.0.5-ITV-ITDS-IF0010, v6.0 anterior a v6.0.0.67 (también conocido como v6.0.0.8-ITV -ITDS-IF0009), v6.1 anterior a v6.1.0.40 (también conocido como v6.1.0.5-ITV-ITDS-IF0003), v6.2 anterior a v6.2.0.16 (también conocido como v6.2.0.3-ITV-ITDS-IF0002), y v6.3 anterior a v6.3.0.3 también conocido como v6.3.0.0-ITV-ITDS-IF0003) permite a atacantes remotos ejecutar código arbitrario a través de un elaborado solicitud LDAP. NOTA: algunos de estos detalles han sido obtenidos de información de terceros.

This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of IBM Tivoli Directory Server. Authentication is not required to exploit this vulnerability.
The specific flaw exists in how ibmslapd.exe handles LDAP CRAM-MD5 packets. ibmslapd.exe listens by default on port TCP 389. When the process receives an LDAP CRAM-MD5 packet, it uses libibmldap.dll to handle the allocation of a buffer for the packet data. A specially crafted packet can cause the ber_get_int function to allocate a buffer that is too small to fit the packet data, causing a subsequent stack-based buffer overflow. This can be leveraged by a remote attacker to execute arbitrary code under the context of the SYSTEM user.

*Credits: Francis Provencher for Protek Research Lab's
CVSS Scores
Attack Vector
Network
Attack Complexity
Low
Authentication
None
Confidentiality
Complete
Integrity
Complete
Availability
Complete
* Common Vulnerability Scoring System
SSVC
  • Decision:-
Exploitation
-
Automatable
-
Tech. Impact
-
* Organization's Worst-case Scenario
Timeline
  • 2011-03-03 CVE Reserved
  • 2011-04-18 CVE Published
  • 2011-04-19 First Exploit
  • 2024-08-04 EPSS Updated
  • 2024-08-06 CVE Updated
  • ---------- Exploited in Wild
  • ---------- KEV Due Date
CWE
  • CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer
CAPEC
Affected Vendors, Products, and Versions
Vendor Product Version Other Status
Vendor Product Version Other Status <-- --> Vendor Product Version Other Status
Ibm
Search vendor "Ibm"
Tivoli Directory Server
Search vendor "Ibm" for product "Tivoli Directory Server"
5.2.0
Search vendor "Ibm" for product "Tivoli Directory Server" and version "5.2.0"
-
Affected
Ibm
Search vendor "Ibm"
Tivoli Directory Server
Search vendor "Ibm" for product "Tivoli Directory Server"
5.2.0.4
Search vendor "Ibm" for product "Tivoli Directory Server" and version "5.2.0.4"
-
Affected
Ibm
Search vendor "Ibm"
Tivoli Directory Server
Search vendor "Ibm" for product "Tivoli Directory Server"
6.0
Search vendor "Ibm" for product "Tivoli Directory Server" and version "6.0"
-
Affected
Ibm
Search vendor "Ibm"
Tivoli Directory Server
Search vendor "Ibm" for product "Tivoli Directory Server"
6.0.0.0
Search vendor "Ibm" for product "Tivoli Directory Server" and version "6.0.0.0"
-
Affected
Ibm
Search vendor "Ibm"
Tivoli Directory Server
Search vendor "Ibm" for product "Tivoli Directory Server"
6.0.0.1
Search vendor "Ibm" for product "Tivoli Directory Server" and version "6.0.0.1"
-
Affected
Ibm
Search vendor "Ibm"
Tivoli Directory Server
Search vendor "Ibm" for product "Tivoli Directory Server"
6.0.0.7
Search vendor "Ibm" for product "Tivoli Directory Server" and version "6.0.0.7"
-
Affected
Ibm
Search vendor "Ibm"
Tivoli Directory Server
Search vendor "Ibm" for product "Tivoli Directory Server"
6.0.0.8
Search vendor "Ibm" for product "Tivoli Directory Server" and version "6.0.0.8"
-
Affected
Ibm
Search vendor "Ibm"
Tivoli Directory Server
Search vendor "Ibm" for product "Tivoli Directory Server"
6.0.0.14
Search vendor "Ibm" for product "Tivoli Directory Server" and version "6.0.0.14"
-
Affected
Ibm
Search vendor "Ibm"
Tivoli Directory Server
Search vendor "Ibm" for product "Tivoli Directory Server"
6.0.0.19
Search vendor "Ibm" for product "Tivoli Directory Server" and version "6.0.0.19"
-
Affected
Ibm
Search vendor "Ibm"
Tivoli Directory Server
Search vendor "Ibm" for product "Tivoli Directory Server"
6.0.0.33
Search vendor "Ibm" for product "Tivoli Directory Server" and version "6.0.0.33"
-
Affected
Ibm
Search vendor "Ibm"
Tivoli Directory Server
Search vendor "Ibm" for product "Tivoli Directory Server"
6.0.0.41
Search vendor "Ibm" for product "Tivoli Directory Server" and version "6.0.0.41"
-
Affected
Ibm
Search vendor "Ibm"
Tivoli Directory Server
Search vendor "Ibm" for product "Tivoli Directory Server"
6.0.0.45
Search vendor "Ibm" for product "Tivoli Directory Server" and version "6.0.0.45"
-
Affected
Ibm
Search vendor "Ibm"
Tivoli Directory Server
Search vendor "Ibm" for product "Tivoli Directory Server"
6.0.0.52
Search vendor "Ibm" for product "Tivoli Directory Server" and version "6.0.0.52"
-
Affected
Ibm
Search vendor "Ibm"
Tivoli Directory Server
Search vendor "Ibm" for product "Tivoli Directory Server"
6.0.0.53
Search vendor "Ibm" for product "Tivoli Directory Server" and version "6.0.0.53"
-
Affected
Ibm
Search vendor "Ibm"
Tivoli Directory Server
Search vendor "Ibm" for product "Tivoli Directory Server"
6.0.0.54
Search vendor "Ibm" for product "Tivoli Directory Server" and version "6.0.0.54"
-
Affected
Ibm
Search vendor "Ibm"
Tivoli Directory Server
Search vendor "Ibm" for product "Tivoli Directory Server"
6.0.0.55
Search vendor "Ibm" for product "Tivoli Directory Server" and version "6.0.0.55"
-
Affected
Ibm
Search vendor "Ibm"
Tivoli Directory Server
Search vendor "Ibm" for product "Tivoli Directory Server"
6.0.0.56
Search vendor "Ibm" for product "Tivoli Directory Server" and version "6.0.0.56"
-
Affected
Ibm
Search vendor "Ibm"
Tivoli Directory Server
Search vendor "Ibm" for product "Tivoli Directory Server"
6.0.0.57
Search vendor "Ibm" for product "Tivoli Directory Server" and version "6.0.0.57"
-
Affected
Ibm
Search vendor "Ibm"
Tivoli Directory Server
Search vendor "Ibm" for product "Tivoli Directory Server"
6.0.0.58
Search vendor "Ibm" for product "Tivoli Directory Server" and version "6.0.0.58"
-
Affected
Ibm
Search vendor "Ibm"
Tivoli Directory Server
Search vendor "Ibm" for product "Tivoli Directory Server"
6.0.0.59
Search vendor "Ibm" for product "Tivoli Directory Server" and version "6.0.0.59"
-
Affected
Ibm
Search vendor "Ibm"
Tivoli Directory Server
Search vendor "Ibm" for product "Tivoli Directory Server"
6.0.0.60
Search vendor "Ibm" for product "Tivoli Directory Server" and version "6.0.0.60"
-
Affected
Ibm
Search vendor "Ibm"
Tivoli Directory Server
Search vendor "Ibm" for product "Tivoli Directory Server"
6.0.0.61
Search vendor "Ibm" for product "Tivoli Directory Server" and version "6.0.0.61"
-
Affected
Ibm
Search vendor "Ibm"
Tivoli Directory Server
Search vendor "Ibm" for product "Tivoli Directory Server"
6.0.0.62
Search vendor "Ibm" for product "Tivoli Directory Server" and version "6.0.0.62"
-
Affected
Ibm
Search vendor "Ibm"
Tivoli Directory Server
Search vendor "Ibm" for product "Tivoli Directory Server"
6.0.0.63
Search vendor "Ibm" for product "Tivoli Directory Server" and version "6.0.0.63"
-
Affected
Ibm
Search vendor "Ibm"
Tivoli Directory Server
Search vendor "Ibm" for product "Tivoli Directory Server"
6.0.0.64
Search vendor "Ibm" for product "Tivoli Directory Server" and version "6.0.0.64"
-
Affected
Ibm
Search vendor "Ibm"
Tivoli Directory Server
Search vendor "Ibm" for product "Tivoli Directory Server"
6.0.0.65
Search vendor "Ibm" for product "Tivoli Directory Server" and version "6.0.0.65"
-
Affected
Ibm
Search vendor "Ibm"
Tivoli Directory Server
Search vendor "Ibm" for product "Tivoli Directory Server"
6.0.0.66
Search vendor "Ibm" for product "Tivoli Directory Server" and version "6.0.0.66"
-
Affected
Ibm
Search vendor "Ibm"
Tivoli Directory Server
Search vendor "Ibm" for product "Tivoli Directory Server"
6.1.0.0
Search vendor "Ibm" for product "Tivoli Directory Server" and version "6.1.0.0"
-
Affected
Ibm
Search vendor "Ibm"
Tivoli Directory Server
Search vendor "Ibm" for product "Tivoli Directory Server"
6.1.0.1
Search vendor "Ibm" for product "Tivoli Directory Server" and version "6.1.0.1"
-
Affected
Ibm
Search vendor "Ibm"
Tivoli Directory Server
Search vendor "Ibm" for product "Tivoli Directory Server"
6.1.0.2
Search vendor "Ibm" for product "Tivoli Directory Server" and version "6.1.0.2"
-
Affected
Ibm
Search vendor "Ibm"
Tivoli Directory Server
Search vendor "Ibm" for product "Tivoli Directory Server"
6.1.0.3
Search vendor "Ibm" for product "Tivoli Directory Server" and version "6.1.0.3"
-
Affected
Ibm
Search vendor "Ibm"
Tivoli Directory Server
Search vendor "Ibm" for product "Tivoli Directory Server"
6.1.0.4
Search vendor "Ibm" for product "Tivoli Directory Server" and version "6.1.0.4"
-
Affected
Ibm
Search vendor "Ibm"
Tivoli Directory Server
Search vendor "Ibm" for product "Tivoli Directory Server"
6.1.0.5
Search vendor "Ibm" for product "Tivoli Directory Server" and version "6.1.0.5"
-
Affected
Ibm
Search vendor "Ibm"
Tivoli Directory Server
Search vendor "Ibm" for product "Tivoli Directory Server"
6.1.0.6
Search vendor "Ibm" for product "Tivoli Directory Server" and version "6.1.0.6"
-
Affected
Ibm
Search vendor "Ibm"
Tivoli Directory Server
Search vendor "Ibm" for product "Tivoli Directory Server"
6.1.0.7
Search vendor "Ibm" for product "Tivoli Directory Server" and version "6.1.0.7"
-
Affected
Ibm
Search vendor "Ibm"
Tivoli Directory Server
Search vendor "Ibm" for product "Tivoli Directory Server"
6.1.0.8
Search vendor "Ibm" for product "Tivoli Directory Server" and version "6.1.0.8"
-
Affected
Ibm
Search vendor "Ibm"
Tivoli Directory Server
Search vendor "Ibm" for product "Tivoli Directory Server"
6.1.0.9
Search vendor "Ibm" for product "Tivoli Directory Server" and version "6.1.0.9"
-
Affected
Ibm
Search vendor "Ibm"
Tivoli Directory Server
Search vendor "Ibm" for product "Tivoli Directory Server"
6.1.0.10
Search vendor "Ibm" for product "Tivoli Directory Server" and version "6.1.0.10"
-
Affected
Ibm
Search vendor "Ibm"
Tivoli Directory Server
Search vendor "Ibm" for product "Tivoli Directory Server"
6.1.0.11
Search vendor "Ibm" for product "Tivoli Directory Server" and version "6.1.0.11"
-
Affected
Ibm
Search vendor "Ibm"
Tivoli Directory Server
Search vendor "Ibm" for product "Tivoli Directory Server"
6.1.0.12
Search vendor "Ibm" for product "Tivoli Directory Server" and version "6.1.0.12"
-
Affected
Ibm
Search vendor "Ibm"
Tivoli Directory Server
Search vendor "Ibm" for product "Tivoli Directory Server"
6.1.0.13
Search vendor "Ibm" for product "Tivoli Directory Server" and version "6.1.0.13"
-
Affected
Ibm
Search vendor "Ibm"
Tivoli Directory Server
Search vendor "Ibm" for product "Tivoli Directory Server"
6.1.0.14
Search vendor "Ibm" for product "Tivoli Directory Server" and version "6.1.0.14"
-
Affected
Ibm
Search vendor "Ibm"
Tivoli Directory Server
Search vendor "Ibm" for product "Tivoli Directory Server"
6.1.0.15
Search vendor "Ibm" for product "Tivoli Directory Server" and version "6.1.0.15"
-
Affected
Ibm
Search vendor "Ibm"
Tivoli Directory Server
Search vendor "Ibm" for product "Tivoli Directory Server"
6.1.0.17
Search vendor "Ibm" for product "Tivoli Directory Server" and version "6.1.0.17"
-
Affected
Ibm
Search vendor "Ibm"
Tivoli Directory Server
Search vendor "Ibm" for product "Tivoli Directory Server"
6.1.0.18
Search vendor "Ibm" for product "Tivoli Directory Server" and version "6.1.0.18"
-
Affected
Ibm
Search vendor "Ibm"
Tivoli Directory Server
Search vendor "Ibm" for product "Tivoli Directory Server"
6.1.0.19
Search vendor "Ibm" for product "Tivoli Directory Server" and version "6.1.0.19"
-
Affected
Ibm
Search vendor "Ibm"
Tivoli Directory Server
Search vendor "Ibm" for product "Tivoli Directory Server"
6.1.0.20
Search vendor "Ibm" for product "Tivoli Directory Server" and version "6.1.0.20"
-
Affected
Ibm
Search vendor "Ibm"
Tivoli Directory Server
Search vendor "Ibm" for product "Tivoli Directory Server"
6.1.0.21
Search vendor "Ibm" for product "Tivoli Directory Server" and version "6.1.0.21"
-
Affected
Ibm
Search vendor "Ibm"
Tivoli Directory Server
Search vendor "Ibm" for product "Tivoli Directory Server"
6.1.0.22
Search vendor "Ibm" for product "Tivoli Directory Server" and version "6.1.0.22"
-
Affected
Ibm
Search vendor "Ibm"
Tivoli Directory Server
Search vendor "Ibm" for product "Tivoli Directory Server"
6.1.0.23
Search vendor "Ibm" for product "Tivoli Directory Server" and version "6.1.0.23"
-
Affected
Ibm
Search vendor "Ibm"
Tivoli Directory Server
Search vendor "Ibm" for product "Tivoli Directory Server"
6.1.0.24
Search vendor "Ibm" for product "Tivoli Directory Server" and version "6.1.0.24"
-
Affected
Ibm
Search vendor "Ibm"
Tivoli Directory Server
Search vendor "Ibm" for product "Tivoli Directory Server"
6.1.0.25
Search vendor "Ibm" for product "Tivoli Directory Server" and version "6.1.0.25"
-
Affected
Ibm
Search vendor "Ibm"
Tivoli Directory Server
Search vendor "Ibm" for product "Tivoli Directory Server"
6.1.0.26
Search vendor "Ibm" for product "Tivoli Directory Server" and version "6.1.0.26"
-
Affected
Ibm
Search vendor "Ibm"
Tivoli Directory Server
Search vendor "Ibm" for product "Tivoli Directory Server"
6.1.0.27
Search vendor "Ibm" for product "Tivoli Directory Server" and version "6.1.0.27"
-
Affected
Ibm
Search vendor "Ibm"
Tivoli Directory Server
Search vendor "Ibm" for product "Tivoli Directory Server"
6.1.0.28
Search vendor "Ibm" for product "Tivoli Directory Server" and version "6.1.0.28"
-
Affected
Ibm
Search vendor "Ibm"
Tivoli Directory Server
Search vendor "Ibm" for product "Tivoli Directory Server"
6.1.0.29
Search vendor "Ibm" for product "Tivoli Directory Server" and version "6.1.0.29"
-
Affected
Ibm
Search vendor "Ibm"
Tivoli Directory Server
Search vendor "Ibm" for product "Tivoli Directory Server"
6.1.0.30
Search vendor "Ibm" for product "Tivoli Directory Server" and version "6.1.0.30"
-
Affected
Ibm
Search vendor "Ibm"
Tivoli Directory Server
Search vendor "Ibm" for product "Tivoli Directory Server"
6.1.0.31
Search vendor "Ibm" for product "Tivoli Directory Server" and version "6.1.0.31"
-
Affected
Ibm
Search vendor "Ibm"
Tivoli Directory Server
Search vendor "Ibm" for product "Tivoli Directory Server"
6.1.0.32
Search vendor "Ibm" for product "Tivoli Directory Server" and version "6.1.0.32"
-
Affected
Ibm
Search vendor "Ibm"
Tivoli Directory Server
Search vendor "Ibm" for product "Tivoli Directory Server"
6.1.0.33
Search vendor "Ibm" for product "Tivoli Directory Server" and version "6.1.0.33"
-
Affected
Ibm
Search vendor "Ibm"
Tivoli Directory Server
Search vendor "Ibm" for product "Tivoli Directory Server"
6.1.0.34
Search vendor "Ibm" for product "Tivoli Directory Server" and version "6.1.0.34"
-
Affected
Ibm
Search vendor "Ibm"
Tivoli Directory Server
Search vendor "Ibm" for product "Tivoli Directory Server"
6.1.0.35
Search vendor "Ibm" for product "Tivoli Directory Server" and version "6.1.0.35"
-
Affected
Ibm
Search vendor "Ibm"
Tivoli Directory Server
Search vendor "Ibm" for product "Tivoli Directory Server"
6.1.0.36
Search vendor "Ibm" for product "Tivoli Directory Server" and version "6.1.0.36"
-
Affected
Ibm
Search vendor "Ibm"
Tivoli Directory Server
Search vendor "Ibm" for product "Tivoli Directory Server"
6.1.0.37
Search vendor "Ibm" for product "Tivoli Directory Server" and version "6.1.0.37"
-
Affected
Ibm
Search vendor "Ibm"
Tivoli Directory Server
Search vendor "Ibm" for product "Tivoli Directory Server"
6.1.0.38
Search vendor "Ibm" for product "Tivoli Directory Server" and version "6.1.0.38"
-
Affected
Ibm
Search vendor "Ibm"
Tivoli Directory Server
Search vendor "Ibm" for product "Tivoli Directory Server"
6.1.0.39
Search vendor "Ibm" for product "Tivoli Directory Server" and version "6.1.0.39"
-
Affected
Ibm
Search vendor "Ibm"
Tivoli Directory Server
Search vendor "Ibm" for product "Tivoli Directory Server"
6.2.0.0
Search vendor "Ibm" for product "Tivoli Directory Server" and version "6.2.0.0"
-
Affected
Ibm
Search vendor "Ibm"
Tivoli Directory Server
Search vendor "Ibm" for product "Tivoli Directory Server"
6.2.0.1
Search vendor "Ibm" for product "Tivoli Directory Server" and version "6.2.0.1"
-
Affected
Ibm
Search vendor "Ibm"
Tivoli Directory Server
Search vendor "Ibm" for product "Tivoli Directory Server"
6.2.0.2
Search vendor "Ibm" for product "Tivoli Directory Server" and version "6.2.0.2"
-
Affected
Ibm
Search vendor "Ibm"
Tivoli Directory Server
Search vendor "Ibm" for product "Tivoli Directory Server"
6.2.0.3
Search vendor "Ibm" for product "Tivoli Directory Server" and version "6.2.0.3"
-
Affected
Ibm
Search vendor "Ibm"
Tivoli Directory Server
Search vendor "Ibm" for product "Tivoli Directory Server"
6.2.0.4
Search vendor "Ibm" for product "Tivoli Directory Server" and version "6.2.0.4"
-
Affected
Ibm
Search vendor "Ibm"
Tivoli Directory Server
Search vendor "Ibm" for product "Tivoli Directory Server"
6.2.0.5
Search vendor "Ibm" for product "Tivoli Directory Server" and version "6.2.0.5"
-
Affected
Ibm
Search vendor "Ibm"
Tivoli Directory Server
Search vendor "Ibm" for product "Tivoli Directory Server"
6.2.0.6
Search vendor "Ibm" for product "Tivoli Directory Server" and version "6.2.0.6"
-
Affected
Ibm
Search vendor "Ibm"
Tivoli Directory Server
Search vendor "Ibm" for product "Tivoli Directory Server"
6.2.0.7
Search vendor "Ibm" for product "Tivoli Directory Server" and version "6.2.0.7"
-
Affected
Ibm
Search vendor "Ibm"
Tivoli Directory Server
Search vendor "Ibm" for product "Tivoli Directory Server"
6.2.0.8
Search vendor "Ibm" for product "Tivoli Directory Server" and version "6.2.0.8"
-
Affected
Ibm
Search vendor "Ibm"
Tivoli Directory Server
Search vendor "Ibm" for product "Tivoli Directory Server"
6.2.0.10
Search vendor "Ibm" for product "Tivoli Directory Server" and version "6.2.0.10"
-
Affected
Ibm
Search vendor "Ibm"
Tivoli Directory Server
Search vendor "Ibm" for product "Tivoli Directory Server"
6.2.0.11
Search vendor "Ibm" for product "Tivoli Directory Server" and version "6.2.0.11"
-
Affected
Ibm
Search vendor "Ibm"
Tivoli Directory Server
Search vendor "Ibm" for product "Tivoli Directory Server"
6.2.0.12
Search vendor "Ibm" for product "Tivoli Directory Server" and version "6.2.0.12"
-
Affected
Ibm
Search vendor "Ibm"
Tivoli Directory Server
Search vendor "Ibm" for product "Tivoli Directory Server"
6.2.0.13
Search vendor "Ibm" for product "Tivoli Directory Server" and version "6.2.0.13"
-
Affected
Ibm
Search vendor "Ibm"
Tivoli Directory Server
Search vendor "Ibm" for product "Tivoli Directory Server"
6.2.0.14
Search vendor "Ibm" for product "Tivoli Directory Server" and version "6.2.0.14"
-
Affected
Ibm
Search vendor "Ibm"
Tivoli Directory Server
Search vendor "Ibm" for product "Tivoli Directory Server"
6.2.0.15
Search vendor "Ibm" for product "Tivoli Directory Server" and version "6.2.0.15"
-
Affected
Ibm
Search vendor "Ibm"
Tivoli Directory Server
Search vendor "Ibm" for product "Tivoli Directory Server"
6.3.0.0
Search vendor "Ibm" for product "Tivoli Directory Server" and version "6.3.0.0"
-
Affected
Ibm
Search vendor "Ibm"
Tivoli Directory Server
Search vendor "Ibm" for product "Tivoli Directory Server"
6.3.0.1
Search vendor "Ibm" for product "Tivoli Directory Server" and version "6.3.0.1"
-
Affected
Ibm
Search vendor "Ibm"
Tivoli Directory Server
Search vendor "Ibm" for product "Tivoli Directory Server"
6.3.0.2
Search vendor "Ibm" for product "Tivoli Directory Server" and version "6.3.0.2"
-
Affected