Home    |    View Topics    |    Search    |    Contact Us    |   



Category:   Application (Directory)  >   Sun ONE Directory Server Vendors:   Sun
Sun Java System Directory Server Lets Remote Users Crash the ns-slapd Service
SecurityTracker Alert ID:  1017814
SecurityTracker URL:
CVE Reference:   CVE-2006-4175   (Links to External Site)
Updated:  May 2 2007
Original Entry Date:  Mar 23 2007
Impact:   Denial of service via network
Fix Available:  Yes  Vendor Confirmed:  Yes  
Version(s): 5.2 2005Q4, possibly other versions
Description:   A vulnerability was reported in Sun Java System Directory Server. A remote user can cause denial of service conditions.

A remote user can send specially crafted queries to cause the target ns-slapd service to crash.

In some cases, the vulnerability may possibly permit remote code execution, but the report did not confirm code execution.

The vendor was notified on August 16, 20006.

iDefense reported this vulnerability.

Impact:   A remote user can cause the target directory service to crash.
Solution:   The vendor has issued a fix (5.2 Patch5).

For the Native Package Versions:

* Solaris Sparc: 115614-27
* Solaris x86: 115615-27
* Linux: 118080-12
* HP-UX : 121393-02

For the PatchZIP (Compressed Archive) versions:

* Linux: 117668-04
* Windows: 117667-04
* HP-UX: 117669-04
* AIX: 117670-04

Sun is working on a final resolution.

The Sun advisory is available at:

Vendor URL: (Links to External Site)
Cause:   Access control error
Underlying OS:  Linux (Any), UNIX (AIX), UNIX (HP/UX), UNIX (Solaris - SunOS), Windows (Any)

Message History:   None.

 Source Message Contents

Subject:  [Full-disclosure] iDefense Security Advisory 03.23.07: Sun Java

Sun Java System Directory Server 5.2 Uninitialized Pointer Cleanup
Design Error Vulnerability

iDefense Security Advisory 03.23.07
Mar 23, 2007


Sun Java System Directory Server is an LDAP server distributed by Sun with
multiple products. More information is available at the following URL.


Remote exploitation of a design error vulnerability in Sun Microsystems
Java System Directory Server 5.2 may cause a denial of service (DoS)

Due to a design error in the clean-up code following certain types of failed
queries, it is possible to cause the server to call the free() function
on an
address obtained from uninitialized memory. This can result in an invalid
memory reference leading to denial of service.


Exploitation of this vulnerability allows remote attackers to cause a denial
of service against the affected server, 'ns-slapd'.

In some situations it may be possible to put information from the remote
attacker in the memory range being accessed which may allow execution of
code, however this has not yet been demonstrated.


iDefense has confirmed Sun Java System Directory Server 5.2 Directory Server
5.2 2005Q4 is affected by this vulnerability. Previous versions are also
suspected to be vulnerable.


Restrict remote access at the network boundary, unless remote parties
service. Access to the affected host should be filtered at the network
boundary if global accessibility is not required. Restricting access to only
trusted hosts and networks may reduce the likelihood of exploitation.


Sun Microsystems Inc. has addressed this issue in Sun Java System Directory
Server 5.2 Patch5. For more information see Sun Alert ID 102853 by visiting
the URL shown below.


The Common Vulnerabilities and Exposures (CVE) project has assigned the
name CVE-2006-4175 to this issue. This is a candidate for inclusion in
the CVE list (, which standardizes names for
security problems.


08/16/2006  Initial vendor notification
08/21/2006  Initial vendor response
03/23/2007  Coordinated public disclosure


The discoverer of this vulnerability wishes to remain anonymous.

Get paid for vulnerability research

Free tools, research and upcoming events


Permission is granted for the redistribution of this alert electronically.
It may not be edited in any way without the express written consent of
iDefense. If you wish to reprint the whole or any part of this alert in
any other medium other than electronically, please e-mail for permission.

Disclaimer: The information in the advisory is believed to be accurate at
the time of publishing based on currently available information. Use of
the information constitutes acceptance for use in an AS IS condition.
There are no warranties with regard to this information. Neither the
author nor the publisher accepts any liability for any direct, indirect,
or consequential loss or damage arising from use of, or reliance on, this

Full-Disclosure - We believe in it.
Hosted and sponsored by Secunia -


Go to the Top of This SecurityTracker Archive Page

Home   |    View Topics   |    Search   |    Contact Us

This web site uses cookies for web analytics. Learn More

Copyright 2021, LLC