CVE-2014-8182 : An off-by-one error leading to a crash was discovered in openldap 2.4 when proce

An off-by-one error leading to a crash was discovered in openldap 2.4 when processing DNS SRV messages. If slapd was configured to use the dnssrv backend, an attacker could crash the service with crafted DNS responses.

Published 2020-01-02 23:15:12

Updated 2020-01-09 16:39:31

Source Red Hat, Inc.

View at NVD, CVE.org

Products affected by CVE-2014-8182

Debian » Debian Linux » Version: 8.0
cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:*
Matching versions
Debian » Debian Linux » Version: 9.0
cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:*
Matching versions
Debian » Debian Linux » Version: 10.0
cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:*
Matching versions
Openldap » Openldap » Version: 2.4
cpe:2.3:a:openldap:openldap:2.4:*:*:*:*:*:*:*
Matching versions

Threat overview for CVE-2014-8182

Top countries where our scanners detected CVE-2014-8182

Top open port discovered on systems with this issue 389

IPs affected by CVE-2014-8182 25

Threat actors abusing to this issue? Yes

Find out if you^* are affected by CVE-2014-8182!

^*Directly or indirectly through your vendors, service providers and 3rd parties. Powered by attack surface intelligence from SecurityScorecard.

Exploit prediction scoring system (EPSS) score for CVE-2014-8182

EPSS FAQ

28.08%

Probability of exploitation activity in the next 30 days EPSS Score History

~ 97 %

Percentile, the proportion of vulnerabilities that are scored at or less

CVSS scores for CVE-2014-8182

Base Score	Base Severity	CVSS Vector	Exploitability Score	Impact Score	Score Source
4.3	MEDIUM	AV:N/AC:M/Au:N/C:N/I:N/A:P	8.6	2.9	NIST
Access Vector: Network Access Complexity: Medium Authentication: None Confidentiality Impact: None Integrity Impact: None Availability Impact: Partial
7.5	HIGH	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H	3.9	3.6	NIST
Attack Vector: Network Attack Complexity: Low Privileges Required: None User Interaction: None Scope: Unchanged Confidentiality: None Integrity: None Availability: High

CWE ids for CVE-2014-8182

CWE-193 Off-by-one Error

A product calculates or uses an incorrect maximum or minimum value that is 1 more, or 1 less, than the correct value.

Assigned by: nvd@nist.gov (Primary)

References for CVE-2014-8182

https://bugzilla.suse.com/show_bug.cgi?id=CVE-2014-8182

Bug 998096 – VUL-1: CVE-2014-8182: nss-pam-ldapd: crash in ldap_domain2hostlist when processing SRV records
Exploit;Issue Tracking;Patch;Third Party Advisory
https://access.redhat.com/security/cve/cve-2014-8182

Red Hat Customer Portal
Third Party Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2014-8182

1095976 – (CVE-2014-8182) CVE-2014-8182 openldap: crash in ldap_domain2hostlist when processing SRV records
Exploit;Issue Tracking;Patch;Third Party Advisory
https://security-tracker.debian.org/tracker/CVE-2014-8182

CVE-2014-8182
Patch;Third Party Advisory