title: ASUS BMC's firmware: buffer overflow - LDAP configuration function
description: The LDAP configuration function in ASUS BMC’s firmware Web management page does not verify the string length entered by users, resulting in a Buffer overflow vulnerability. As obtaining the privileged permission, remote attackers use the leakage to abnormally terminate the Web service.
problem types: CWE-120 Buffer Overflow
affected:
{
product:  BMC firmware for Z10PR-D16
vendor: ASUS
versions:
status: affected, version: 1.14.51
}
{
product:  BMC firmware for ASMB8-iKVM
vendor: ASUS
versions:
status: affected, version: 1.14.51
}
{
product:  BMC firmware for Z10PE-D16 WS
vendor: ASUS
versions:
status: affected, version: 1.14.2
}
metrics:
cvssV3_1: [
attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 4.9
baseSeverity: MEDIUM
confidentialityImpact: NONE
integrityImpact: NONE
privilegesRequired: HIGH
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H
version: 3.1
]
solutions: update BMC's firmwares to the following versions:
Z10PR-D16 1.16.1
ASMB8-iKVM 1.16.1
Z10PE-D16 WS 1.16.1