CVE-2008-2943 Use after free in n/a
Remote authenticated administrators can cause denial of service or execute arbitrary code via a double free vulnerability in IBM Tivoli Directory Server.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2008-2943?
CVE-2008-2943 is a medium-severity use after free vulnerability in n/a, published on 30 Jun 2008. An attacker needs administrator access to exploit it, with no action from the victim.
Official description
Double free vulnerability in IBM Tivoli Directory Server (TDS) 6.1.0.0 through 6.1.0.15 allows remote authenticated administrators to cause a denial of service (ABEND) and possibly execute arbitrary code by using ldapadd to attempt to create a duplicate ibm-globalAdminGroup LDAP database entry. NOTE: the vendor states "There is no real risk of a vulnerability," although there are likely scenarios in which a user is allowed to make administrative LDAP requests but does not have the privileges to stop the server.
Weakness: CWE-399
Which versions are affected by CVE-2008-2943?
It affects 1 product.
Products include Ibm Tivoli Directory Server.
How do I fix CVE-2008-2943?
No fix has been published for CVE-2008-2943 yet. Limit exposure of the affected software until one is available.
Upgrade to the fixed version. These bugs are found with fuzzing and sanitisers and avoided by memory-safe languages. More about Use after free.
Is CVE-2008-2943 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2008-2943 exists.
Public exploit code: 1 Exploit-DB entry.
Other vulnerabilities in n/a
Sources
Also known as GHSA-cmj9-rpfq-5hc2.