SecurityTracker.com
    Home    |    View Topics    |    Search    |    Contact Us    |   

SecurityTracker
Archives


 


Category:   Application (Directory)  >   Microsoft Active Directory Vendors:   Microsoft
Microsoft Active Directory Stack Memory Consumption Flaw Lets Remote Users Deny Service
SecurityTracker Alert ID:  1023156
SecurityTracker URL:  http://securitytracker.com/id/1023156
CVE Reference:   CVE-2009-1928   (Links to External Site)
Date:  Nov 10 2009
Impact:   Denial of service via network
Fix Available:  Yes  Vendor Confirmed:  Yes  

Description:   A vulnerability was reported in Microsoft Active Directory. A remote user can cause denial of service conditions.

A remote user can send specially crafted LDAP or LDAPS requests to consume all available stack memory on the target system and cause the target system to stop responding.

Active Directory Application Mode (ADAM) is affected when installed on Windows XP and Windows Server 2003. Active Directory Lightweight Directory Service (AD LDS) on Windows Server 2008 is also affected.

Impact:   A remote user can cause the target system to stop responding.
Solution:   The vendor has issued the following fixes:

Microsoft Windows 2000 Server Service Pack 4, Active Directory:

http://www.microsoft.com/downloads/details.aspx?familyid=297158cf-374c-45d9-b213-978e1f54d244

Windows XP Service Pack 2 and Windows XP Service Pack 3, Active Directory Application Mode (ADAM):

http://www.microsoft.com/downloads/details.aspx?familyid=cbe09780-f288-457a-b254-58c9c8744055

Windows XP Professional x64 Edition Service Pack 2, Active Directory Application Mode (ADAM):

http://www.microsoft.com/downloads/details.aspx?familyid=b65ddf36-a02d-4aa2-9b4f-7416dbf59e2a

Windows Server 2003 Service Pack 2, Active Directory:

http://www.microsoft.com/downloads/details.aspx?familyid=28f1c494-4e16-43b6-93d2-49e15f142ac9

Windows Server 2003 x64 Edition Service Pack 2, Active Directory:

http://www.microsoft.com/downloads/details.aspx?familyid=509aeec0-112b-44ab-8686-43f381b61940

Windows Server 2003 with SP2 for Itanium-based Systems, Active Directory:

http://www.microsoft.com/downloads/details.aspx?familyid=040e691b-1ef0-4b73-bef7-a1d77b84b0ca

Windows Server 2008 for 32-bit Systems and Windows Server 2008 for 32-bit Systems Service Pack 2*, Active Directory and Active Directory Lightweight Directory Service (AD LDS):

http://www.microsoft.com/downloads/details.aspx?familyid=701abf15-7f93-41de-8d09-13404fd79a7e

Windows Server 2008 for x64-based Systems and Windows Server 2008 for x64-based Systems Service Pack 2*, Active Directory and Active Directory Lightweight Directory Service (AD LDS):

http://www.microsoft.com/downloads/details.aspx?familyid=17f5f9e0-5869-41da-9b3b-6e67540af1f0

A restart is required.

The Microsoft advisory is available at:

http://www.microsoft.com/technet/security/bulletin/ms09-066.mspx

Vendor URL:  www.microsoft.com/technet/security/bulletin/ms09-066.mspx (Links to External Site)
Cause:   Boundary error
Underlying OS:  Windows (2000), Windows (2003), Windows (2008), Windows (XP)
Underlying OS Comments:  2000 SP4, 2003 SP2, XP SP3, 2008 SP2; and prior service packs

Message History:   None.


 Source Message Contents



[Original Message Not Available for Viewing]


Go to the Top of This SecurityTracker Archive Page





Home   |    View Topics   |    Search   |    Contact Us

This web site uses cookies for web analytics. Learn More

Copyright 2019, SecurityGlobal.net LLC