Denial Of Service (DoS)

389-ds-base is vulnerable to denial of service DoS attacks. The vulnerability exists as ns-slapd in 389 Directory Server before 1.3.0.8 allows remote attackers to cause a denial of service server crash via a crafted Distinguished Name DN in a MOD operation request...

Information Disclosure

redhat-ds-base is vulnerable to information disclosure attacks. The vulnerability exists as the Red Hat Directory Server before 8.2.11-13 and 389 Directory Server do not properly restrict access to entity attributes, which allows remote authenticated users to obtain sensitive information via a...

Denial Of Service (DoS)

389 Directory Server is vulnerable to denial of service. The acllashandlegroupentry function in servers/plugins/acl/acllas.c does not properly handle access control instructions ACI that use certificate groups and cause ns-slapd to enter an infinite loop which consumes excessive CPU resources and...

Denial Of Service (DoS)

389 Directory Server is vulnerable to denial of service. Get Effective Rights GER search queries are not properly handled when the attribute list contains the @ characters. An attacker is able submit search queries containing multiple @ characters to crash the application...

Information Disclosure

389 Directory Server is vulnerable to information disclosure. This is due to improper access restriction in the dosearch function in ldap/servers/slapd/search.c when the nsslapd-allow-anonymous-access configuration is set to rootdse and the BASE search scope is used, allowing a remote attacker to...

Red Hat 389 Directory Server vslapd_log_emergency_error Denial of Service (CVE-2018-14624)

A denial-of-service vulnerability has been reported in 389 Directory Server. The vulnerability is due to improper use of the lock controlling the error log when the log file is reopened. A remote, unauthenticated attacker could send LDAP requests to a very large DN to trigger the vulnerability...

Red Hat 389 Directory Server do_search Denial of Service (CVE-2018-14648)

A denial-of-service vulnerability has been reported in 389 Directory Server. The vulnerability is due to improper processing of LDAP search queries in the dosearch function in servers/slapd/search.c. A remote, unauthenticated attacker could exploiting this vulnerability by sending crafted LDAP...

Red Hat 389 Directory Server ns-slapd ldapsearch Buffer Overflow (CVE-2018-1089)

A stack buffer overflow vulnerability has been discovered in 389 Directory Server. The vulnerability is due to improper handling of overly long filter values within ldapsearch queries. A remote attacker can issue a crafted query in order to trigger the vulnerability and cause arbitrary code...

Security Bulletin: Multiple vulnerabilities in IBM Java SDK affect IBM Security Directory Server

Summary There are multiple vulnerabilities in IBM® SDK Java™ Technology Edition, Version 6 and Version 8 used by IBM Security Directory Server SDS. These issues were disclosed as part of the IBM Java SDK updates in July 2018, April 2018, January 2018, October 2017, July 2017, and January 2017...

Red Hat 389 Directory Server Denial of Service (CVE-2018-10935)

A denial of service vulnerability exists in Nagios XI in the Lightweight Directory Access Protocol LDAP service. The vulnerability is due to improper processing of LDAP search queries. Successful exploitation of the vulnerability could cause the process to abnormally terminate...

Security Bulletin: Vulnerabilities in GSKit affect IBM Tivoli Directory Server and IBM Security Directory Server for AIX

Summary There are multiple vulnerabilities in GSKit that affect IBM Tivoli Directory Server and IBM Security Directory Server for AIX. Vulnerability Details CVEID: CVE-2018-1388 DESCRIPTION: GSKit V7 may disclose side channel information via discrepencies between valid and invalid PKCS1 padding...

Vulnerabilities in GSKit affect IBM Tivoli Directory Server and IBM Security Directory Server for AIX

IBM SECURITY ADVISORY First Issued: Fri Dec 14 12:09:04 CST 2018 The most recent version of this document is available here: http://aix.software.ibm.com/aix/efixes/security/itdsadvisory2.asc https://aix.software.ibm.com/aix/efixes/security/itdsadvisory2.asc...

Security Bulletin: IBM Security Directory Server is affected by a vulnerability in GSKit

Summary IBM Security Directory Server has addressed the following vulnerability caused by an issue in GSKit. Vulnerability Details CVEID: CVE-2018-1388 DESCRIPTION: GSKit V7 may disclose side channel information via discrepencies between valid and invalid PKCS1 padding. CVSS Base Score: 9.1 CVSS...

Moderate: Red Hat Security Advisory: 389-ds-base security and bug fix update

An update for 389-ds-base is now available for Red Hat Enterprise Linux 7.5 Extended Update Support. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available...

RHEL 7 : 389-ds-base (RHSA-2018:3127)

An update for 389-ds-base is now available for Red Hat Enterprise Linux 7. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability fro...

Medium: 389-ds-base

Issue Overview: A vulnerability was discovered in 389-ds-base. The lock controlling the error log was not correctly used when re-opening the log file in logerroremergency. An attacker could send a flood of modifications to a very large DN, which would cause slapd to crash.CVE-2018-14624 A race...

Security Bulletin: Multiple vulnerabilities in IBM Java Runtime affect Rational Directory Server (Tivoli) & Rational Directory Administrator

Summary There are multiple vulnerabilities in IBM® Runtime Environment Java™ Version 7 and Version 8 used by Rational Directory Server Tivoli and Rational Directory Administrator. These issues were disclosed as part of the IBM Java SDK updates in July 2018. Upgrade the JRE in order to resolve the...

Null pointer dereference

Incorrect handling of an invalid value for an HTTP request parameter by Directory Server aka Enterprise Server Administration web UI in Micro Focus Enterprise Developer and Enterprise Server 2.3 Update 2 and earlier, 3.0 before Patch Update 12, and 4.0 before Patch Update 2 causes a null pointer...

CVE-2018-12469

Incorrect handling of an invalid value for an HTTP request parameter by Directory Server aka Enterprise Server Administration web UI in Micro Focus Enterprise Developer and Enterprise Server 2.3 Update 2 and earlier, 3.0 before Patch Update 12, and 4.0 before Patch Update 2 causes a null pointer...

CVE-2018-12469

Incorrect handling of an invalid value for an HTTP request parameter by Directory Server aka Enterprise Server Administration web UI in Micro Focus Enterprise Developer and Enterprise Server 2.3 Update 2 and earlier, 3.0 before Patch Update 12, and 4.0 before Patch Update 2 causes a null pointer...