CVE-2008-2943
Estado: ModificadaMedia (6)—💥 Exploit
Double free vulnerability in IBM Tivoli Directory Server (TDS) 6.1.0.0 through 6.1.0.15 allows remote authenticated administrators to cause a denial of service (ABEND) and possibly execute arbitrary code by using ldapadd to attempt to create a duplicate ibm-globalAdminGroup LDAP database entry. NOTE: the vendor states "There is no real risk of a vulnerability," although there are likely scenarios in which a user is allowed to make administrative LDAP requests but does not have the privileges to stop the server.
CVSS
- Versión: 2.0
- Vector: AV:N/AC:M/Au:S/C:P/I:P/A:P
- Puntuación base: 6
Probabilidad de explotación (EPSS)
- Probabilidad de explotación en los próximos 30 días: 2.42%
- Percentil entre todas las CVEs puntuadas: 84
- Fecha de la puntuación: 6/10/2026
EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).
💥 Exploits públicos
Hay código de explotación o plantillas de detección públicos. No es lo mismo que explotación activa confirmada (KEV), pero aumenta el riesgo: parchee con prioridad.
- Publicado en Exploit-DB · IBM Tivoli Directory Server 6.1.x - Adding 'ibm-globalAdminGroup' Entry Denial of Service (30/6/2008)
Tecnologías afectadas (1)
CWE
- CWE-399
Referencias
- http://secunia.com/advisories/30786
- http://www-1.ibm.com/support/docview.wss?uid=swg1IO09113
- http://www.securityfocus.com/bid/30010
- http://www.vupen.com/english/advisories/2008/1970
- https://exchange.xforce.ibmcloud.com/vulnerabilities/43465
- http://secunia.com/advisories/30786
- http://www-1.ibm.com/support/docview.wss?uid=swg1IO09113
- http://www.securityfocus.com/bid/30010
- http://www.vupen.com/english/advisories/2008/1970
- https://exchange.xforce.ibmcloud.com/vulnerabilities/43465
JSON original (NVD)
Mostrar
{
"id": "CVE-2008-2943",
"cveTags": [],
"metrics": {
"cvssMetricV2": [
{
"type": "Primary",
"source": "nvd@nist.gov",
"cvssData": {
"version": "2.0",
"baseScore": 6,
"accessVector": "NETWORK",
"vectorString": "AV:N/AC:M/Au:S/C:P/I:P/A:P",
"authentication": "SINGLE",
"integrityImpact": "PARTIAL",
"accessComplexity": "MEDIUM",
"availabilityImpact": "PARTIAL",
"confidentialityImpact": "PARTIAL"
},
"acInsufInfo": false,
"impactScore": 6.4,
"baseSeverity": "MEDIUM",
"obtainAllPrivilege": false,
"exploitabilityScore": 6.8,
"obtainUserPrivilege": false,
"obtainOtherPrivilege": true,
"userInteractionRequired": false
}
]
},
"affected": [
{
"source": "cve@mitre.org",
"affectedData": [
{
"vendor": "n/a",
"product": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
]
}
],
"published": "2008-06-30T21:41:00.000",
"references": [
{
"url": "http://secunia.com/advisories/30786",
"tags": [
"Vendor Advisory"
],
"source": "cve@mitre.org"
},
{
"url": "http://www-1.ibm.com/support/docview.wss?uid=swg1IO09113",
"source": "cve@mitre.org"
},
{
"url": "http://www.securityfocus.com/bid/30010",
"source": "cve@mitre.org"
},
{
"url": "http://www.vupen.com/english/advisories/2008/1970",
"source": "cve@mitre.org"
},
{
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/43465",
"source": "cve@mitre.org"
},
{
"url": "http://secunia.com/advisories/30786",
"tags": [
"Vendor Advisory"
],
"source": "af854a3a-2127-422b-91ae-364da2661108"
},
{
"url": "http://www-1.ibm.com/support/docview.wss?uid=swg1IO09113",
"source": "af854a3a-2127-422b-91ae-364da2661108"
},
{
"url": "http://www.securityfocus.com/bid/30010",
"source": "af854a3a-2127-422b-91ae-364da2661108"
},
{
"url": "http://www.vupen.com/english/advisories/2008/1970",
"source": "af854a3a-2127-422b-91ae-364da2661108"
},
{
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/43465",
"source": "af854a3a-2127-422b-91ae-364da2661108"
}
],
"vulnStatus": "Modified",
"weaknesses": [
{
"type": "Primary",
"source": "nvd@nist.gov",
"description": [
{
"lang": "en",
"value": "CWE-399"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Double free vulnerability in IBM Tivoli Directory Server (TDS) 6.1.0.0 through 6.1.0.15 allows remote authenticated administrators to cause a denial of service (ABEND) and possibly execute arbitrary code by using ldapadd to attempt to create a duplicate ibm-globalAdminGroup LDAP database entry. NOTE: the vendor states \"There is no real risk of a vulnerability,\" although there are likely scenarios in which a user is allowed to make administrative LDAP requests but does not have the privileges to stop the server."
},
{
"lang": "es",
"value": "Vulnerabilidad de doble libreación en IBM Tivoli Directory Server (TDS) 6.1.0.0 hasta 6.1.0.15 que permite a los administradores la autenticación remota para causar una denegación de servicios (ABEND) y posiblemente ejecutar códico arbitrario utilizando ldapadd para conseguir crear un duplicado en la base de datos de entrada ibm-globalAdminGroup LDAP.\r\nNOTA: el vendedor declara \"no hya un riesgo real de vulnerabilidad\", aunque hay posibles escenarios en los que un usuario puede hacer peticiones al LDAP administrativo pero no tiene privilegios para parar el servidor"
}
],
"lastModified": "2026-06-16T22:54:47.503",
"configurations": [
{
"nodes": [
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:a:ibm:tivoli_directory_server:6.1.0.0:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "2F468434-0317-435A-B2A6-5923A88A090F"
},
{
"criteria": "cpe:2.3:a:ibm:tivoli_directory_server:6.1.0.1:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "E79197BC-3BDF-4F38-B63F-1B2A658B645F"
},
{
"criteria": "cpe:2.3:a:ibm:tivoli_directory_server:6.1.0.2:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "F7B1402A-B3C3-4210-928F-6EFCCE2DE1CF"
},
{
"criteria": "cpe:2.3:a:ibm:tivoli_directory_server:6.1.0.3:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "92D48F0B-C9E2-4381-8463-83FF47136EB8"
},
{
"criteria": "cpe:2.3:a:ibm:tivoli_directory_server:6.1.0.4:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "36308D0C-D92C-4857-A857-097F383EE76C"
},
{
"criteria": "cpe:2.3:a:ibm:tivoli_directory_server:6.1.0.5:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "A84CEB80-796F-4928-A2A0-73E604543A70"
},
{
"criteria": "cpe:2.3:a:ibm:tivoli_directory_server:6.1.0.6:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "462385FC-F345-42EE-ABF0-E1781CC648A9"
},
{
"criteria": "cpe:2.3:a:ibm:tivoli_directory_server:6.1.0.7:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "F10F3910-5616-41A2-A3BF-18FA4DD68631"
},
{
"criteria": "cpe:2.3:a:ibm:tivoli_directory_server:6.1.0.8:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "51C34738-5F9B-43A7-987F-EB805B31119E"
},
{
"criteria": "cpe:2.3:a:ibm:tivoli_directory_server:6.1.0.9:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "6AA93B63-9D15-4784-8585-DBC139A382E7"
},
{
"criteria": "cpe:2.3:a:ibm:tivoli_directory_server:6.1.0.10:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "55D84E30-1F23-4A6A-B622-78DBEEBEFB46"
},
{
"criteria": "cpe:2.3:a:ibm:tivoli_directory_server:6.1.0.11:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "50C9A7DF-6968-41CC-911A-B746CB43AA82"
},
{
"criteria": "cpe:2.3:a:ibm:tivoli_directory_server:6.1.0.12:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "0EA493E1-F791-4FE5-9F7E-36CAC0D942C2"
},
{
"criteria": "cpe:2.3:a:ibm:tivoli_directory_server:6.1.0.13:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "F7365156-4EA3-476A-A395-FADEDF1BA80A"
},
{
"criteria": "cpe:2.3:a:ibm:tivoli_directory_server:6.1.0.14:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "321B15BC-2653-4B64-A5AE-9FCA6A08713C"
},
{
"criteria": "cpe:2.3:a:ibm:tivoli_directory_server:6.1.0.15:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "5A1B527B-E07D-4543-92A6-0EE58CB8FECC"
}
],
"operator": "OR"
}
]
}
],
"sourceIdentifier": "cve@mitre.org"
}