CVE-2008-2928: Buffer Overflow
A flaw was found in a Accept Language HTTP header parsers implemented in adminutil library used by various Red Hat Directory Server's Administration Server's CGI scripts. A remote attacker able to connect to Administration Server web interface could cause a CGI scripts to crash, or possibly execute an arbitrary code.
Issue affects: - Red Hat Directory Server 7.1 - adminutil packages shipped in Red Hat Directory Server 8 and Fedora Directory Server, prior to adminutil version 1.1.7
Other sources
Multiple buffer overflows in the adminutil library in CGI applications in Red Hat Directory Server 7.1 before SP7 allow remote attackers to cause a denial of service (daemon crash) or possibly execute arbitrary code via a crafted Accept-Language HTTP header.
— MITRE
Affected Software
Remediation
Patch Available
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2008-2928?
CVE-2008-2928 has been assigned a moderate severity due to the potential for server crashes and possible exploitation via CGI scripts.
How do I fix CVE-2008-2928?
To fix CVE-2008-2928, upgrade to the latest version of Red Hat Directory Server beyond 7.1 sp6 that addresses this vulnerability.
Which versions of Red Hat Directory Server are affected by CVE-2008-2928?
CVE-2008-2928 affects all versions of Red Hat Directory Server 7.1 up to and including sp6.
Can CVE-2008-2928 be exploited remotely?
Yes, a remote attacker with access to the Administration Server web interface can exploit CVE-2008-2928.
What can happen if CVE-2008-2928 is exploited?
Exploitation of CVE-2008-2928 could lead to a crash of the CGI scripts or potentially allow code execution.