The host is running IBM Tivoli Directory Server and is prone to remote code execution vulnerability.

Successful exploitation could allow remote attackers to execute arbitrary code within the context of the affected application or retrieve potentially sensitive information. Impact Level: Application

Apply patches https://www-304.ibm.com/support/docview.wss?uid=swg24029672 https://www-304.ibm.com/support/docview.wss?uid=swg24029663 https://www-304.ibm.com/support/docview.wss?uid=swg24029661 https://www-304.ibm.com/support/docview.wss?uid=swg24029660

The flaw is caused by a stack overflow error in the 'ibmslapd.exe' component when allocating a buffer via the 'ber_get_int()' function within 'libibmldap.dll' while handling LDAP CRAM-MD5 packets, which could be exploited by remote unauthenticated attackers to execute arbitrary code with SYSTEM privileges.

IBM Tivoli Directory Server 5.2 before 5.2.0.5-TIV-ITDS-IF0010, 6.0 before 6.0.0.67 (6.0.0.8-TIV-ITDS-IF0009), 6.1 before 6.1.0.40 (6.1.0.5-TIV-ITDS-IF0003), 6.2 before 6.2.0.16 (6.2.0.3-TIV-ITDS-IF0002), and 6.3 before 6.3.0.3

• http://secunia.com/advisories/44184
• http://securitytracker.com/id?1025358
• http://www.exploit-db.com/exploits/17188/

---

Updated on 2017-03-28