CVE-2008-7289

MediumCVSS 4.0/10Last modified Jun 16, 2026

Description

IBM Tivoli Directory Server (TDS) 5.2 before 5.2.0.5-TIV-ITDS-LA0007 does not properly handle the simultaneous changing of multiple passwords, which makes it easier for remote authenticated users to cause a denial of service (DB2 daemon deadlock) by making password changes that trigger updates to a DB2 password-history table.

Metrics

CVSS 2.0 4.0/10AV:N/AC:L/Au:S/C:N/I:N/A:P

Weakness enumeration

CWE-20

Affected software

No affected versions have been published.

Timeline

Published: Apr 21, 2011
Last modified: Jun 16, 2026
NVD status: Modified

Related CVEs from 2008

CVE-2008-72904.0Memory leak in the ldap_explode_rdn API function in IBM Tivoli Directory Server (TDS) 5.2 before 5.2.0.5-TIV-ITDS-LA0007 allows remote authe CVE-2008-72919.8gri before 2.12.18 generates temporary files in an insecure way.CVE-2008-72922.1Bugzilla 2.20.x before 2.20.5, 2.22.x before 2.22.3, and 3.0.x before 3.0.3 on Windows does not delete the temporary files associated with u CVE-2008-72935.8Mozilla Firefox before 4 cannot properly restrict modifications to cookies established in HTTPS sessions, which allows man-in-the-middle att CVE-2008-72945.8Google Chrome before 4.0.211.0 cannot properly restrict modifications to cookies established in HTTPS sessions, which allows man-in-the-midd CVE-2008-72955.8Microsoft Internet Explorer cannot properly restrict modifications to cookies established in HTTPS sessions, which allows man-in-the-middle CVE-2008-72965.8Apple Safari cannot properly restrict modifications to cookies established in HTTPS sessions, which allows man-in-the-middle attackers to ov CVE-2008-72975.8Opera cannot properly restrict modifications to cookies established in HTTPS sessions, which allows man-in-the-middle attackers to overwrite CVE-2008-72985.8The Android browser in Android cannot properly restrict modifications to cookies established in HTTPS sessions, which allows man-in-the-midd CVE-2008-72995.0IBM Tivoli Federated Identity Manager (TFIM) 6.2.0 before 6.2.0.2 uses an incomplete SAML 1.x browser-artifact, which allows remote OpenID p CVE-2008-73008.5The labeled networking implementation in Solaris Trusted Extensions in Sun Solaris 10 and OpenSolaris snv_39 through snv_67, when a labeled CVE-2008-73017.5SQL injection vulnerability in admin/login.php in jSite 1.0 OE allows remote attackers to execute arbitrary SQL commands via the username pa