----------------------------------------------------------------------


  Secunia CSI
+ Microsoft SCCM
-----------------------
= Extensive Patch Management

http://secunia.com/vulnerability_scanning/corporate/wsus_sccm_3rd_third_party_patching/


----------------------------------------------------------------------

TITLE:
Sun Java System Directory Server Multiple Vulnerabilities

SECUNIA ADVISORY ID:
SA39437

VERIFY ADVISORY:
http://secunia.com/advisories/39437/

DESCRIPTION:
Some vulnerabilities have been reported in Sun Java System Directory
Server, which can be exploited by malicious people to cause a DoS
(Denial of Service) or potentially compromise a vulnerable system.

1) An NULL-pointer dereference error exists in the DSML (Directory
Service Markup Language) over HTTP implementation. This can be
exploited to cause a crash via a search request containing a
malformed username.

2) An error in the LDAP implementation related to ASN.1 parsing can
be exploited to cause a buffer overflow via a malformed LDAP query.

Successful exploitation of this vulnerability may allow execution of
arbitrary code.

3) An error in the DSML over HTTP implementation can be exploited to
terminate an affected application via an XML request containing
certain UTF-8 characters.

SOLUTION:
Apply patches.

Sun Java System Directory Server Enterprise Edition 6.3.1:
Apply patch 143463-01 or later.

Sun Java System Directory Server 5.2 Patch 6:
Apply patch 143462-01 or later.

PROVIDED AND/OR DISCOVERED BY:
An anonymous person, reported via ZDI.

ORIGINAL ADVISORY:
Oracle:
http://sunsolve.sun.com/search/document.do?assetkey=1-66-276210-1

ZDI:
http://www.zerodayinitiative.com/advisories/ZDI-10-073/
http://www.zerodayinitiative.com/advisories/ZDI-10-074/
http://www.zerodayinitiative.com/advisories/ZDI-10-075/

----------------------------------------------------------------------

About:
This Advisory was delivered by Secunia as a free service to help
private users keeping their systems up to date against the latest
vulnerabilities.

Subscribe:
http://secunia.com/advisories/secunia_security_advisories/

Definitions: (Criticality, Where etc.)
http://secunia.com/advisories/about_secunia_advisories/


Please Note:
Secunia recommends that you verify all advisories you receive by
clicking the link.
Secunia NEVER sends attached files with advisories.
Secunia does not advise people to install third party patches, only
use those supplied by the vendor.

----------------------------------------------------------------------

Unsubscribe: Secunia Security Advisories
http://secunia.com/sec_adv_unsubscribe/?email=packet%40packetstormsecurity.org

----------------------------------------------------------------------