FKIE_CVE-2009-3862

Vulnerability from fkie_nvd - Published: 2009-11-04 18:30 - Updated: 2026-06-16 23:12
Severity
Summary
The NDSD process in Novell eDirectory 8.7.3 before 8.7.3.10 ftf2 and eDirectory 8.8 before 8.8.5 ftf1 does not properly handle certain LDAP search requests, which allows remote attackers to cause a denial of service (application hang) via a search request with a NULL BaseDN value.
References
cve@mitre.orghttp://www.novell.com/support/viewContent.do?externalId=7004721Patch, Vendor Advisory
cve@mitre.orghttp://www.securityfocus.com/bid/36902
cve@mitre.orghttp://www.vupen.com/english/advisories/2009/3120Patch, Vendor Advisory
cve@mitre.orghttp://www.zerodayinitiative.com/advisories/ZDI-09-075/Patch
af854a3a-2127-422b-91ae-364da2661108http://www.novell.com/support/viewContent.do?externalId=7004721Patch, Vendor Advisory
af854a3a-2127-422b-91ae-364da2661108http://www.securityfocus.com/bid/36902
af854a3a-2127-422b-91ae-364da2661108http://www.vupen.com/english/advisories/2009/3120Patch, Vendor Advisory
af854a3a-2127-422b-91ae-364da2661108http://www.zerodayinitiative.com/advisories/ZDI-09-075/Patch
Impacted products
Vendor Product Version
novell edirectory 8.7.3
novell edirectory 8.7.3
novell edirectory 8.7.3
novell edirectory 8.7.3
novell edirectory 8.7.3
novell edirectory 8.7.3
novell edirectory 8.7.3
novell edirectory 8.7.3
novell edirectory 8.7.3
novell edirectory 8.7.3.8
novell edirectory 8.7.3.9
novell edirectory 8.8
novell edirectory 8.8
novell edirectory 8.8
novell edirectory 8.8
novell edirectory 8.8
novell edirectory 8.8.1
novell edirectory 8.8.2
To clipboard 

{
  "affected": [
    {
      "affectedData": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "source": "cve@mitre.org"
    }
  ],
  "configurations": [
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:novell:edirectory:8.7.3:*:*:*:*:*:*:*",
              "matchCriteriaId": "029ADE6D-6761-4196-847C-A0EFB3A06341",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:novell:edirectory:8.7.3:sp2:windows:*:*:*:*:*",
              "matchCriteriaId": "15E2B599-2B96-4ED3-B2D9-E4D6909A1F26",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:novell:edirectory:8.7.3:sp3:windows:*:*:*:*:*",
              "matchCriteriaId": "9DAFE77C-4AB9-4865-B673-C32EAB3ABB75",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:novell:edirectory:8.7.3:sp4:windows:*:*:*:*:*",
              "matchCriteriaId": "5FC5947C-15F7-4BF0-9C0A-F2817F4BB7D0",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:novell:edirectory:8.7.3:sp5:windows:*:*:*:*:*",
              "matchCriteriaId": "2A57D5D2-F490-4A33-AFAF-A66CE7988F0E",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:novell:edirectory:8.7.3:sp6:windows:*:*:*:*:*",
              "matchCriteriaId": "1694F7CA-0E7B-4DC6-9B74-FCCE8B81F048",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:novell:edirectory:8.7.3:sp7:windows:*:*:*:*:*",
              "matchCriteriaId": "042CF2E0-CE2C-4939-899A-F193127A28B6",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:novell:edirectory:8.7.3:sp8:windows:*:*:*:*:*",
              "matchCriteriaId": "2A7E430B-DD25-4BE7-8495-B4FD8EB60F19",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:novell:edirectory:8.7.3:sp9:windows:*:*:*:*:*",
              "matchCriteriaId": "142A95E7-009C-4A54-AA04-97C7120C228E",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:novell:edirectory:8.7.3.8:*:*:*:*:*:*:*",
              "matchCriteriaId": "9E8D4976-BAE9-4A83-9DF6-9436C54E8413",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:novell:edirectory:8.7.3.9:*:*:*:*:*:*:*",
              "matchCriteriaId": "A626A123-E33A-445F-93A2-8FA3B2E3E53A",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:novell:edirectory:8.8:*:*:*:*:*:*:*",
              "matchCriteriaId": "D7548D05-AD2B-46C3-9036-366585FFCB48",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:novell:edirectory:8.8:sp1:*:*:*:*:*:*",
              "matchCriteriaId": "03D34570-657E-48D5-B778-9510C3D0FF7C",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:novell:edirectory:8.8:sp2:*:*:*:*:*:*",
              "matchCriteriaId": "2EA7ED79-2E4E-4BE0-B167-31BB6311A506",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:novell:edirectory:8.8:sp3:*:*:*:*:*:*",
              "matchCriteriaId": "FC9CE828-3461-4A32-8DD6-ED8BDA0298FF",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:novell:edirectory:8.8:sp4:*:*:*:*:*:*",
              "matchCriteriaId": "A78EBF3A-4073-41D2-BD52-E598318D4996",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:novell:edirectory:8.8.1:*:*:*:*:*:*:*",
              "matchCriteriaId": "C13882AD-D700-4B95-9BB2-B3E0D104B227",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:novell:edirectory:8.8.2:*:*:*:*:*:*:*",
              "matchCriteriaId": "A8FDCB14-9380-42C3-A6EE-3E6AEA3F52F2",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "The NDSD process in Novell eDirectory 8.7.3 before 8.7.3.10 ftf2 and eDirectory 8.8 before 8.8.5 ftf1 does not properly handle certain LDAP search requests, which allows remote attackers to cause a denial of service (application hang) via a search request with a NULL BaseDN value."
    },
    {
      "lang": "es",
      "value": "El proceso NDSD en Novell eDirectory v8.7.3 anterior a v8.7.3.10 ftf2 y eDirectory v8.8 anterior a v8.8.5 ftf1 no maneja adecuadamente ciertas peticiones de b\u00fasqueda de LDAP, lo que permite a atacantes remoto provocar una denegaci\u00f3n de servicio (cuelgue de aplicaci\u00f3n) a trav\u00e9s de una petici\u00f3n de b\u00fasqueda con valor BaseDN NULL."
    }
  ],
  "evaluatorSolution": "Per: http://www.novell.com/support/viewContent.do?externalId=7004721\r\n\r\n\"Resolution\r\n\r\nThis vulnerability is resolved in eDirectory 8.8.5 ftf1 and eDirectory 8.7.3.10 ftf2.\r\n\r\nTo resolve this problem, apply eDirectory 8.8.5 ftf1 or newer for eDirectory 8.8.X and eDirectory 8.7.3.10 ftf2 for eDirectory 8.7.3.X.  Patches are available at http://download.novell.com\"",
  "id": "CVE-2009-3862",
  "lastModified": "2026-06-16T23:12:29.853",
  "metrics": {
    "cvssMetricV2": [
      {
        "acInsufInfo": false,
        "baseSeverity": "MEDIUM",
        "cvssData": {
          "accessComplexity": "LOW",
          "accessVector": "NETWORK",
          "authentication": "NONE",
          "availabilityImpact": "PARTIAL",
          "baseScore": 5.0,
          "confidentialityImpact": "NONE",
          "integrityImpact": "NONE",
          "vectorString": "AV:N/AC:L/Au:N/C:N/I:N/A:P",
          "version": "2.0"
        },
        "exploitabilityScore": 10.0,
        "impactScore": 2.9,
        "obtainAllPrivilege": false,
        "obtainOtherPrivilege": false,
        "obtainUserPrivilege": false,
        "source": "nvd@nist.gov",
        "type": "Primary",
        "userInteractionRequired": false
      }
    ]
  },
  "published": "2009-11-04T18:30:00.217",
  "references": [
    {
      "source": "cve@mitre.org",
      "tags": [
        "Patch",
        "Vendor Advisory"
      ],
      "url": "http://www.novell.com/support/viewContent.do?externalId=7004721"
    },
    {
      "source": "cve@mitre.org",
      "url": "http://www.securityfocus.com/bid/36902"
    },
    {
      "source": "cve@mitre.org",
      "tags": [
        "Patch",
        "Vendor Advisory"
      ],
      "url": "http://www.vupen.com/english/advisories/2009/3120"
    },
    {
      "source": "cve@mitre.org",
      "tags": [
        "Patch"
      ],
      "url": "http://www.zerodayinitiative.com/advisories/ZDI-09-075/"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Patch",
        "Vendor Advisory"
      ],
      "url": "http://www.novell.com/support/viewContent.do?externalId=7004721"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://www.securityfocus.com/bid/36902"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Patch",
        "Vendor Advisory"
      ],
      "url": "http://www.vupen.com/english/advisories/2009/3120"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Patch"
      ],
      "url": "http://www.zerodayinitiative.com/advisories/ZDI-09-075/"
    }
  ],
  "sourceIdentifier": "cve@mitre.org",
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-287"
        }
      ],
      "source": "nvd@nist.gov",
      "type": "Primary"
    }
  ]
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.