Pantek Library
Hosting Provided By
CybrHost
High Speed Hosting

SUNWlldap vulnerability

From: Brent J. Nordquist <b-nordquist(at)bethel.edu>
Date: Tue Mar 18 2003 - 12:21:32 EST


The listing at http://securityfocus.com/bid/7064 says that Solaris x86's LDAP code is vulnerable when resolving host names that are too long. I think I'm inferring from the README for patch 108993-13 (Solaris 8 SPARC) that Solaris SPARC is vulnerable too.

The problem is that 108993-13 requires a minimum pthreads patch level, which requires a minimum kernel patch level, and both of those require a reboot. This one will be a pain to deploy.

I haven't seen any discussion on this issue (Bugtraq etc.) so I'm trying to figure out how serious the vulnerability is. What have other people decided about installing 108993-13? Has anyone determined which code that links with LDAP libraries might be vulnerable, and how (local or remote, root, etc.)?

-- 
Brent J. Nordquist  N0BJN
Other contact information: 
http://kepler.acns.bethel.edu/~bjn/contact.html
Received on Tue Mar 18 17:44:42 2003

This archive was generated by hypermail 2.1.8 : Wed Aug 23 2006 - 14:01:37 EDT


Contact Us  Legal Notices  Order Services Online 
Pantek Home  Privacy Policy  IT news  Site Map  Pantek Library