Sun Java System Directory Server 5.2 Uninitialized Pointer Cleanup
Design Error Vulnerability

iDefense Security Advisory 03.23.07
http://labs.idefense.com/intelligence/vulnerabilities/
Mar 23, 2007

I. BACKGROUND

Sun Java System Directory Server is an LDAP server distributed by Sun with
multiple products. More information is available at the following URL.

http://www.sun.com/software/products/directory_srvr/home_directory.xml

II. DESCRIPTION

Remote exploitation of a design error vulnerability in Sun Microsystems
Inc.'s
Java System Directory Server 5.2 may cause a denial of service (DoS)
condition.

Due to a design error in the clean-up code following certain types of failed
queries, it is possible to cause the server to call the free() function
on an
address obtained from uninitialized memory. This can result in an invalid
memory reference leading to denial of service.

III. ANALYSIS

Exploitation of this vulnerability allows remote attackers to cause a denial
of service against the affected server, 'ns-slapd'.

In some situations it may be possible to put information from the remote
attacker in the memory range being accessed which may allow execution of
code, however this has not yet been demonstrated.

IV. DETECTION

iDefense has confirmed Sun Java System Directory Server 5.2 Directory Server
5.2 2005Q4 is affected by this vulnerability. Previous versions are also
suspected to be vulnerable.

V. WORKAROUND

Restrict remote access at the network boundary, unless remote parties
require
service. Access to the affected host should be filtered at the network
boundary if global accessibility is not required. Restricting access to only
trusted hosts and networks may reduce the likelihood of exploitation.

VI. VENDOR RESPONSE

Sun Microsystems Inc. has addressed this issue in Sun Java System Directory
Server 5.2 Patch5. For more information see Sun Alert ID 102853 by visiting
the URL shown below.

http://sunsolve.sun.com/search/document.do?assetkey=1-26-102853-1

VII. CVE INFORMATION

The Common Vulnerabilities and Exposures (CVE) project has assigned the
name CVE-2006-4175 to this issue. This is a candidate for inclusion in
the CVE list (http://cve.mitre.org/), which standardizes names for
security problems.

VIII. DISCLOSURE TIMELINE

08/16/2006  Initial vendor notification
08/21/2006  Initial vendor response
03/23/2007  Coordinated public disclosure

IX. CREDIT

The discoverer of this vulnerability wishes to remain anonymous.

Get paid for vulnerability research
http://labs.idefense.com/methodology/vulnerability/vcp.php

Free tools, research and upcoming events
http://labs.idefense.com/

X. LEGAL NOTICES

Copyright © 2007 iDefense, Inc.

Permission is granted for the redistribution of this alert electronically.
It may not be edited in any way without the express written consent of
iDefense. If you wish to reprint the whole or any part of this alert in
any other medium other than electronically, please e-mail
customerservice@idefense.com for permission.

Disclaimer: The information in the advisory is believed to be accurate at
the time of publishing based on currently available information. Use of
the information constitutes acceptance for use in an AS IS condition.
There are no warranties with regard to this information. Neither the
author nor the publisher accepts any liability for any direct, indirect,
or consequential loss or damage arising from use of, or reliance on, this
information.