Security readout for executives and security teams
Plain-English summary
This issue could let a remote attacker crash a 389 Directory Server replica if it runs version 1.2.7.5 built with mozldap. The available sources describe denial of service, not data theft or privilege escalation.
Executive priority
Treat this as a legacy-service resilience risk. It is not supported by evidence of compromise, but crashing directory replicas can disrupt authentication-dependent business services.
Technical view
CVE-2011-0704 concerns 389 Directory Server 1.2.7.5 built with mozldap. An empty modify request can cause a replica crash. The bundle provides no CVSS score, CWE, named patch level, or detailed affected-platform matrix.
Likely exposure
Exposure appears limited to organizations still running 389 Directory Server 1.2.7.5 with mozldap-built components, especially replica servers reachable by untrusted networks.
Exploitation context
The source bundle describes remote denial of service. It does not identify active exploitation, KEV inclusion, public exploit maturity, or weaponized activity.
Researcher notes
The public bundle is sparse. The key constraints are version 1.2.7.5 and mozldap build usage. No CVSS, CWE, fix version, or active exploitation evidence is provided.
Mitigation direction
- Inventory 389 Directory Server versions and build options.
- Check Red Hat and 389 Directory Server guidance for the corrected release.
- Restrict untrusted network access to directory replication and LDAP services.
- Prioritize replacement or upgrade of version 1.2.7.5 deployments.
- Monitor directory replicas for unexpected crashes or restart loops.
Validation and detection
- Confirm whether any replica runs 389 Directory Server 1.2.7.5.
- Determine whether affected builds use mozldap.
- Review crash logs for empty modify request correlation.
- Verify directory services are not exposed to untrusted networks.
- Document compensating controls for any unpatched legacy instance.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CVE-2011-0704 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Unknown
- CVSS
- Not scored
- Known Exploited
- No
- Published
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS and timeline data
No CVSS vectors or timeline events were available in the normalized CVE source material.
Source materials
- CVE List V5 sourceCVE List V5
- https://bugzilla.redhat.com/show_bug.cgi?id=675320CVE reference · x_refsource_CONFIRM
- https://bugzilla.redhat.com/show_bug.cgi?id=676876CVE reference · x_refsource_CONFIRM
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.