CVE-2001-1321: High severity Oracle Internet Directory vulnerability

Published Jul 16, 2001

Updated

Oracle Internet Directory Server 2.1.1.x and 3.0.1 allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via invalid encodings of BER OBJECT-IDENTIFIER values, as demonstrated by the PROTOS LDAPv3 test suite.

Affected Software

2 affected components

Oracle Internet Directory=2.1.1

Oracle Internet Directory=3.0.1

Remediation

Patch Available

http://ciac.llnl.gov/ciac/bulletins/l-116.shtml

Event History

Jul 16, 2001

CVE Published

04:00 AM

May 3, 2002

CVE Published

via MITRE·08:00 AM

Data Sourced

via MITRE·08:00 AM

Description

Frequently Asked Questions

What is the severity of CVE-2001-1321?

CVE-2001-1321 has a high severity due to its potential to cause denial of service and possible arbitrary code execution.

How do I fix CVE-2001-1321?

To fix CVE-2001-1321, upgrade Oracle Internet Directory to version 2.1.1.1 or later, or to version 3.0.2 or later.

What systems are affected by CVE-2001-1321?

CVE-2001-1321 affects Oracle Internet Directory versions 2.1.1 and 3.0.1.

Can CVE-2001-1321 be exploited remotely?

Yes, CVE-2001-1321 can be exploited remotely by attackers using invalid encodings of BER OBJECT-IDENTIFIER values.

Is there a known exploit for CVE-2001-1321?

Yes, the vulnerability has been demonstrated using the PROTOS LDAPv3 test suite.