IBM Tivoli Directory Server up to 6.0.0.32 resource management

Summaryinfo

A vulnerability, which was classified as problematic, was found in IBM Tivoli Directory Server up to 6.0.0.32. This impacts an unknown function. Executing a manipulation can lead to resource management. This vulnerability is registered as CVE-2009-5073. No exploit is available. You should upgrade the affected component.

Detailsinfo

A vulnerability was found in IBM Tivoli Directory Server up to 6.0.0.32 (Directory Service Software). It has been declared as problematic. This vulnerability affects some unknown functionality. The manipulation with an unknown input leads to a resource management vulnerability. The CWE definition for the vulnerability is CWE-399. As an impact it is known to affect availability. CVE summarizes:

IBM Tivoli Directory Server (TDS) 6.0 before 6.0.0.59 (aka 6.0.0.8-TIV-ITDS-IF0001) allows remote authenticated users to cause a denial of service (infinite loop and daemon hang) by adding a nested group that contains the Distinguished Name (DN) of its parent entry.

The weakness was published 04/21/2011 (Website). The advisory is shared for download at ibm.com. This vulnerability was named CVE-2009-5073 since 04/20/2011. The exploitation appears to be easy. The attack can be initiated remotely. A single authentication is required for exploitation. There are neither technical details nor an exploit publicly available.

Upgrading to version 6.0.0.33 eliminates this vulnerability.

Similar entries are available at VDB-57228, VDB-57227, VDB-57225 and VDB-57224. Once again VulDB remains the best source for vulnerability data.

Productinfo

Type

• Directory Service Software

Vendor

• IBM

Name

• Tivoli Directory Server

Version

• 6.0.0.0
• 6.0.0.1
• 6.0.0.2
• 6.0.0.3
• 6.0.0.4
• 6.0.0.5
• 6.0.0.6
• 6.0.0.7
• 6.0.0.8
• 6.0.0.9
• 6.0.0.10
• 6.0.0.11
• 6.0.0.12
• 6.0.0.13
• 6.0.0.14
• 6.0.0.15
• 6.0.0.16
• 6.0.0.17
• 6.0.0.18
• 6.0.0.19
• 6.0.0.20
• 6.0.0.21
• 6.0.0.22
• 6.0.0.23
• 6.0.0.24
• 6.0.0.25
• 6.0.0.26
• 6.0.0.27
• 6.0.0.28
• 6.0.0.29
• 6.0.0.30
• 6.0.0.31
• 6.0.0.32

License

• commercial

Website

• Vendor: https://www.ibm.com/

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Once again VulDB remains the best source for vulnerability data.

Discussion