Vulnerability Details : CVE-2015-0283
The slapi-nis plug-in before 0.54.2 does not properly reallocate memory when processing user accounts, which allows remote attackers to cause a denial of service (infinite loop and CPU consumption) via a request for a (1) group with a large number of members or (2) user that belongs to a large number of groups.
Vulnerability category: Denial of service
Products affected by CVE-2015-0283
- cpe:2.3:a:redhat:slapi-nis:*:*:*:*:*:*:*:*
Exploit prediction scoring system (EPSS) score for CVE-2015-0283
2.36%
Probability of exploitation activity in the next 30 days
EPSS Score History
~ 90 %
Percentile, the proportion of vulnerabilities that are scored at or less
CVSS scores for CVE-2015-0283
| Base Score | Base Severity | CVSS Vector | Exploitability Score | Impact Score | Score Source | First Seen |
|---|---|---|---|---|---|---|
|
7.8
|
HIGH | AV:N/AC:L/Au:N/C:N/I:N/A:C |
10.0
|
6.9
|
NIST |
CWE ids for CVE-2015-0283
-
Assigned by: nvd@nist.gov (Primary)
References for CVE-2015-0283
-
http://www.securityfocus.com/bid/73377
slapi-nis Directory Server Plugin CVE-2015-0283 Multiple Remote Denial of Service Vulnerabilities
-
http://lists.fedoraproject.org/pipermail/package-announce/2015-March/154103.html
[SECURITY] Fedora 22 Update: freeipa-4.1.4-1.fc22
-
http://lists.fedoraproject.org/pipermail/package-announce/2015-April/154314.html
[SECURITY] Fedora 21 Update: freeipa-4.1.4-1.fc21
-
https://bugzilla.redhat.com/show_bug.cgi?id=1195729
1195729 – (CVE-2015-0283) CVE-2015-0283 slapi-nis: infinite loop in getgrnam_r() and getgrgid_r()
-
https://git.fedorahosted.org/cgit/slapi-nis.git/commit/?id=6573f91c95f7a353ad3bdf2fe95b0c15932aa097
Infrastructure/Fedorahosted-retirement - Fedora Project Wiki
-
http://rhn.redhat.com/errata/RHSA-2015-0728.html
RHSA-2015:0728 - Security Advisory - Red Hat Customer Portal
Jump to