Lucene search

K
mageiaGentoo FoundationMGASA-2013-0263
HistoryAug 30, 2013 - 9:23 p.m.

Updated 389-ds-base packag fixes security vulnerabilies and incorrect group usage

2013-08-3021:23:22
Gentoo Foundation
advisories.mageia.org
14

5 Medium

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

PARTIAL

AV:N/AC:L/Au:N/C:N/I:N/A:P

0.013 Low

EPSS

Percentile

85.8%

Updated 389-ds-base packages fix security vulnerabilities: It was discovered that the 389 Directory Server did not honor defined attribute access controls when evaluating search filter expressions. A remote attacker (with permission to query the Directory Server) could use this flaw to determine the values of restricted attributes via a series of search queries with filter conditions that used restricted attributes (CVE-2013-2219). It was discovered that the 389 Directory Server did not properly handle the receipt of certain MOD operations with a bogus Distinguished Name (DN). A remote, unauthenticated attacker could use this flaw to cause the 389 Directory Server to crash (CVE-2013-4283). Additionally, problems of wrong default group nobody (from upstream) as well as the 389-ds server not starting after a reboot have been fixed (mga#10138).

OSVersionArchitecturePackageVersionFilename
Mageia3noarch389-ds-base< 1.3.0.8-1389-ds-base-1.3.0.8-1.mga3

5 Medium

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

PARTIAL

AV:N/AC:L/Au:N/C:N/I:N/A:P

0.013 Low

EPSS

Percentile

85.8%