CVE-2009-1138 Information

Description

The LDAP service in Active Directory on Microsoft Windows 2000 SP4 does not properly free memory for LDAP and LDAPS requests which allows remote attackers to execute arbitrary code via a request that uses hexadecimal encoding whose associated memory is not released related to a \DN AttributeValue\ aka \Active Directory Invalid Free Vulnerability.\ NOTE: this issue is probably a memory leak.

Reference

http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=804 http://osvdb.org/54937 http://secunia.com/advisories/35355 http://support.avaya.com/elmodocs2/security/ASA-2009-214.htm http://www.securityfocus.com/bid/35226 http://www.securitytracker.com/id?1022349 http://www.us-cert.gov/cas/techalerts/TA09-160A.html http://www.vupen.com/english/advisories/2009/1537 https://docs.microsoft.com/en-us/security-updates/securitybulletins/2009/ms09-018 https://oval.cisecurity.org/repository/search/definition/oval3Aorg.mitre.oval3Adef3A6180