CVE-2015-0283

slapi-nis < 0.54.1 - Denial of Service via Large Group Membership Requests

Title source: llm
STIX 2.1

Description

The slapi-nis plug-in before 0.54.2 does not properly reallocate memory when processing user accounts, which allows remote attackers to cause a denial of service (infinite loop and CPU consumption) via a request for a (1) group with a large number of members or (2) user that belongs to a large number of groups.

References (6)

Core 6
Core References
Mailing List, Third Party Advisory vendor-advisory x_refsource_fedora
http://lists.fedoraproject.org/pipermail/package-announce/2015-April/154314.html
Mailing List, Third Party Advisory vendor-advisory x_refsource_fedora
http://lists.fedoraproject.org/pipermail/package-announce/2015-March/154103.html
Third Party Advisory, VDB Entry vdb-entry x_refsource_bid
http://www.securityfocus.com/bid/73377
Issue Tracking x_refsource_confirm
https://bugzilla.redhat.com/show_bug.cgi?id=1195729
Vendor Advisory vendor-advisory x_refsource_redhat
http://rhn.redhat.com/errata/RHSA-2015-0728.html

Scores

EPSS 0.0312
EPSS Percentile 86.5%

Details

CWE
CWE-399
Status published
Products (1)
redhat/slapi-nis < 0.54.1
Published Mar 30, 2015
Tracked Since Feb 18, 2026