CVE-2008-7289: Input Validation

Published Apr 21, 2011

Updated

IBM Tivoli Directory Server (TDS) 5.2 before 5.2.0.5-TIV-ITDS-LA0007 does not properly handle the simultaneous changing of multiple passwords, which makes it easier for remote authenticated users to cause a denial of service (DB2 daemon deadlock) by making password changes that trigger updates to a DB2 password-history table.

Affected Software

2 affected components

IBM Tivoli Directory Server=5.2.0

IBM Tivoli Directory Server=5.2.0.4

Remediation

Patch Available

http://www.ibm.com/support/docview.wss?uid=swg24029663

Event History

Apr 21, 2011

CVE Published

via MITRE·10:00 AM

Data Sourced

via MITRE·10:00 AM

Description

Frequently Asked Questions

What is the severity of CVE-2008-7289?

CVE-2008-7289 has a moderate severity level due to its potential to cause denial of service.

How do I fix CVE-2008-7289?

To fix CVE-2008-7289, upgrade IBM Tivoli Directory Server to version 5.2.0.5 or later.

What software versions are affected by CVE-2008-7289?

CVE-2008-7289 affects IBM Tivoli Directory Server versions 5.2.0 and 5.2.0.4.

What type of vulnerability is CVE-2008-7289?

CVE-2008-7289 is a denial of service vulnerability caused by improper handling of concurrent password changes.

Who can exploit CVE-2008-7289?

Remote authenticated users can exploit CVE-2008-7289 to trigger a denial of service.