Vulnerability in IBM Tivoli Directory Server

CVE-2008-2943

Double free vulnerability in IBM Tivoli Directory Server (TDS) 6.1.0.0 through 6.1.0.15 allows remote authenticated administrators to cause a denial of service (ABEND) and possibly execute arbitrary code by using ldapadd to attempt to create a duplicate ibm-globalAdminGroup LDAP database entry. NOTE: the vendor states "There is no real risk of a vulnerability," although there are likely scenarios in which a user is allowed to make administrative LDAP requests but does not have the privileges to stop the server.

EPSS: 0.024 (82.5th percentile) — read the EPSS interpretation.

Affected products

Ibm Tivoli_directory_server — versions 6.1.0.0, 6.1.0.1, 6.1.0.2
N/a — versions n/a

Weakness classification (CWE)

CWE-399

References

cve@mitre.org (vdb-entry, x_refsource_XF)
cve@mitre.org (vdb-entry, x_refsource_VUPEN)
cve@mitre.org (vendor-advisory, x_refsource_AIXAPAR)
cve@mitre.org (vdb-entry, x_refsource_BID)
cve@mitre.org (x_refsource_SECUNIA, Vendor Advisory, third-party-advisory)