Important: 389-ds-base

2015-06-0222:24:00

alas.aws.amazon.com

5 Medium

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:L/Au:N/C:N/I:P/A:N

7.5 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

HIGH

Availability Impact

NONE

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

0.003 Low

EPSS

Percentile

71.1%

JSON

Issue Overview:

A flaw was found in the authorization of modrdn operations. An unauthenticated attacker able to issue an ldapmodrdn call to the directory server could use this flaw to perform unauthorized modifications of entries in the directory server.

Affected Packages:

389-ds-base

Issue Correction:
Run yum update 389-ds-base to update your system.

New Packages:

i686:  
    389-ds-base-devel-1.3.3.1-16.41.amzn1.i686  
    389-ds-base-libs-1.3.3.1-16.41.amzn1.i686  
    389-ds-base-1.3.3.1-16.41.amzn1.i686  
    389-ds-base-debuginfo-1.3.3.1-16.41.amzn1.i686  
  
src:  
    389-ds-base-1.3.3.1-16.41.amzn1.src  
  
x86_64:  
    389-ds-base-1.3.3.1-16.41.amzn1.x86_64  
    389-ds-base-devel-1.3.3.1-16.41.amzn1.x86_64  
    389-ds-base-debuginfo-1.3.3.1-16.41.amzn1.x86_64  
    389-ds-base-libs-1.3.3.1-16.41.amzn1.x86_64

Additional References

Red Hat: CVE-2015-1854

Mitre: CVE-2015-1854

OSVersionArchitecturePackageVersionFilename
Amazon Linux1i686389-ds-base-devel< 1.3.3.1-16.41.amzn1389-ds-base-devel-1.3.3.1-16.41.amzn1.i686.rpm
Amazon Linux1i686389-ds-base-libs< 1.3.3.1-16.41.amzn1389-ds-base-libs-1.3.3.1-16.41.amzn1.i686.rpm
Amazon Linux1i686389-ds-base< 1.3.3.1-16.41.amzn1389-ds-base-1.3.3.1-16.41.amzn1.i686.rpm
Amazon Linux1i686389-ds-base-debuginfo< 1.3.3.1-16.41.amzn1389-ds-base-debuginfo-1.3.3.1-16.41.amzn1.i686.rpm
Amazon Linux1x86_64389-ds-base< 1.3.3.1-16.41.amzn1389-ds-base-1.3.3.1-16.41.amzn1.x86_64.rpm
Amazon Linux1x86_64389-ds-base-devel< 1.3.3.1-16.41.amzn1389-ds-base-devel-1.3.3.1-16.41.amzn1.x86_64.rpm
Amazon Linux1x86_64389-ds-base-debuginfo< 1.3.3.1-16.41.amzn1389-ds-base-debuginfo-1.3.3.1-16.41.amzn1.x86_64.rpm
Amazon Linux1x86_64389-ds-base-libs< 1.3.3.1-16.41.amzn1389-ds-base-libs-1.3.3.1-16.41.amzn1.x86_64.rpm

OS	Version	Architecture	Package	Version	Filename
Amazon Linux	1	i686	389-ds-base-devel	< 1.3.3.1-16.41.amzn1	389-ds-base-devel-1.3.3.1-16.41.amzn1.i686.rpm
Amazon Linux	1	i686	389-ds-base-libs	< 1.3.3.1-16.41.amzn1	389-ds-base-libs-1.3.3.1-16.41.amzn1.i686.rpm
Amazon Linux	1	i686	389-ds-base	< 1.3.3.1-16.41.amzn1	389-ds-base-1.3.3.1-16.41.amzn1.i686.rpm
Amazon Linux	1	i686	389-ds-base-debuginfo	< 1.3.3.1-16.41.amzn1	389-ds-base-debuginfo-1.3.3.1-16.41.amzn1.i686.rpm
Amazon Linux	1	x86_64	389-ds-base	< 1.3.3.1-16.41.amzn1	389-ds-base-1.3.3.1-16.41.amzn1.x86_64.rpm
Amazon Linux	1	x86_64	389-ds-base-devel	< 1.3.3.1-16.41.amzn1	389-ds-base-devel-1.3.3.1-16.41.amzn1.x86_64.rpm
Amazon Linux	1	x86_64	389-ds-base-debuginfo	< 1.3.3.1-16.41.amzn1	389-ds-base-debuginfo-1.3.3.1-16.41.amzn1.x86_64.rpm
Amazon Linux	1	x86_64	389-ds-base-libs	< 1.3.3.1-16.41.amzn1	389-ds-base-libs-1.3.3.1-16.41.amzn1.x86_64.rpm