Unscored severity · published Aug 7, 2012
CVE-2012-3429
The dns_to_ldap_dn_escape function in src/ldap_convert.c in bind-dyndb-ldap 1.1.0rc1 and earlier does not properly escape distinguished names (DN) for LDAP queries, which allows…
–
CVSS
3.1%
EPSS
No
On KEV
Description
The dns_to_ldap_dn_escape function in src/ldap_convert.c in bind-dyndb-ldap 1.1.0rc1 and earlier does not properly escape distinguished names (DN) for LDAP queries, which allows remote DNS servers to cause a denial of service (named service hang) via a "$" character in a DN in a DNS query.
Exploitation
Is it being used?
Exploit prediction (EPSS)3.1% · higher than 88% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
BI
Bind-dyndb-ldap · Martin Nagy
through 1.1.0; 0.1.0; 0.1.0; 0.2.0; 1.0.0; 1.0.0; +4 more · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2012-3429
CVE.org
https://www.cve.org/CVERecord?id=CVE-2012-3429
Exploit
http://git.fedorahosted.org/cgit/bind-dyndb-ldap.git/commit/?id=f345805c73c294db42452ae966c48fbc36c48006
rhn.redhat.com
http://rhn.redhat.com/errata/RHSA-2012-1139.html
Vendor Advisory
http://secunia.com/advisories/50086
Vendor Advisory
http://secunia.com/advisories/50159
www.openwall.com
http://www.openwall.com/lists/oss-security/2012/08/02/5
www.securityfocus.com
http://www.securityfocus.com/bid/54787
More from Bind-dyndb-ldap
–
CVE-2012-2134
The handle_connection_error function in ldap_helper.c in bind-dyndb-ldap before 1.1.0rc1 does not properly handle LDAP query errors, which allows remote attackers to cause a…