iDefense Security Advisory 07.15.08 – Remote exploitation of a pre-authentication input validation vulnerability in Oracle Corp.’s Oracle Internet Directory allows an attacker to conduct a denial of service attack on a vulnerable host. Internet Directory consists of two processes. One process acts as a listener. It handles incoming connections and passes them off to the second process. The second process, which handles requests, contains the vulnerability. When processing a malformed LDAP request, it is possible to cause the handler to dereference a NULL pointer. This results in the process crashing. Future connection requests will be accepted by the listener process, and then immediately closed when it finds that there is no handler process running. iDefense confirmed the existence of this vulnerability in Oracle Internet Directory for Windows version 10.1.4.0.1 with the April 2007 CPU installed. Previous versions may also be affected.
You can download this advisory from the following link: https://packetstormsecurity.com/files/download/68228/07.15.08-1.txt
Source: https://packetstormsecurity.com/files/68228/iDEFENSE-Security-Advisory-2008-07-15.1.html