CVE-2019-14824

CVE-2019-14824 affects 389-ds-base and its deref plugin, enabling an authenticated attacker to disclose attribute values by abusing the search permission (e.g., password hashes). Public details across connected docs confirm the flaw and show patches across multiple distros: Debian (fixed in 1.3.3...

CVE-2019-14824

A flaw was found in the 'deref' plugin of 389-ds-base where it could use the 'search' permission to display attribute values. In some configurations, this could allow an authenticated attacker to view private attributes, such as password hashes...

CVE-2019-14824

A flaw was found in the 'deref' plugin of 389-ds-base where it could use the 'search' permission to display attribute values. In some configurations, this could allow an authenticated attacker to view private attributes, such as password hashes...

CVE-2019-14824

A flaw was found in the 'deref' plugin of 389-ds-base where it could use the 'search' permission to display attribute values. In some configurations, this could allow an authenticated attacker to view private attributes, such as password hashes...

Red Hat '389-ds-base' CVE-2019-14824 Security Bypass Vulnerability

Description Red Hat '389-ds-base' is prone to a security-bypass vulnerability. Attackers can exploit this issue to bypass certain security restrictions, obtain sensitive information and perform unauthorized actions. This may aid in further attacks. Technologies Affected Redhat 389-ds-base Redhat...

NewStart CGSL CORE 5.04 / MAIN 5.04 : 389-ds-base Vulnerability (NS-SA-2019-0181)

The remote NewStart CGSL host, running version CORE 5.04 / MAIN 5.04, has 389-ds-base packages installed that are affected by a vulnerability: - In 389-ds-base up to version 1.4.1.2, requests are handled by workers threads. Each sockets will be waited by the worker for at most 'ioblocktimeout'...

CVE-2017-2668

An invalid pointer dereference flaw was found in the way 389-ds-base handled LDAP bind requests. A remote unauthenticated attacker could use this flaw to make ns-slapd crash via a specially crafted LDAP bind request, resulting in denial of service...

CVE-2018-1054

An out-of-bounds memory read flaw was found in the way 389-ds-base handled certain LDAP search filters. A remote, unauthenticated attacker could potentially use this flaw to make ns-slapd crash via a specially crafted LDAP request, thus resulting in denial of service...

NewStart CGSL CORE 5.05 / MAIN 5.05 : 389-ds-base Vulnerability (NS-SA-2019-0170)

The remote NewStart CGSL host, running version CORE 5.05 / MAIN 5.05, has 389-ds-base packages installed that are affected by a vulnerability: - In 389-ds-base up to version 1.4.1.2, requests are handled by workers threads. Each sockets will be waited by the worker for at most 'ioblocktimeout'...

PT-2019-11642 · Red Hat +3 · 389-Ds-Base +4

Name of the Vulnerable Software and Affected Versions: 389-ds-base versions 1.4.x.x before 1.4.1.3 Description: A flaw has been found in the software. When executed in verbose mode, the dscreate and dsconf commands may display sensitive information, such as the Directory Manager password. An...

Amazon Linux AMI : 389-ds-base (ALAS-2019-1261)

1693612 : 389-ds-base: DoS via hanging secured connections It was found that encrypted connections did not honor the 'ioblocktimeout' parameter to end blocking requests. As a result, an unauthenticated attacker could repeatedly start a sufficient number of encrypted connections to block all...

RHEL 7 : 389-ds-base (RHSA-2019:1896)

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2019:1896 advisory. 389 Directory Server is an LDAP version 3 LDAPv3 compliant server. The base packages include the Lightweight Directory Access Protocol LDAP server an...

NewStart CGSL CORE 5.04 / MAIN 5.04 : 389-ds-base Multiple Vulnerabilities (NS-SA-2019-0038)

The remote NewStart CGSL host, running version CORE 5.04 / MAIN 5.04, has 389-ds-base packages installed that are affected by multiple vulnerabilities: - A race condition was found in the way 389-ds-base handles persistent search, resulting in a crash if the server is under load. An anonymous...

NewStart CGSL CORE 5.04 / MAIN 5.04 : 389-ds-base Vulnerability (NS-SA-2019-0062)

The remote NewStart CGSL host, running version CORE 5.04 / MAIN 5.04, has 389-ds-base packages installed that are affected by a vulnerability: - It was found that a specially crafted search query could lead to excessive CPU consumption in the dosearch function. An unauthenticated attacker could u...

Scientific Linux Security Update : 389-ds-base on SL7.x x86_64 (20190729)

Security Fixes : - 389-ds-base: DoS via hanging secured connections CVE-2019-3883 Bug Fixes : - Previously, if you were using the PAM plugin and attempted to bind as a dn that doesn't exist, the server would crash. This has now been fixed. C Tenable Network Security, Inc. The descriptive text is ...

CentOS 7 : 389-ds-base (CESA-2019:1896)

An update for 389-ds-base is now available for Red Hat Enterprise Linux 7. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability fro...

NewStart CGSL MAIN 5.04 : 389-ds-base Multiple Vulnerabilities (NS-SA-2019-0009)

The remote NewStart CGSL host, running version MAIN 5.04, has 389-ds-base packages installed that are affected by multiple vulnerabilities: - An out-of-bounds memory read flaw was found in the way 389-ds-base handled certain LDAP search filters. A remote, unauthenticated attacker could potentiall...

NewStart CGSL MAIN 4.05 : 389-ds-base Vulnerability (NS-SA-2019-0140)

The remote NewStart CGSL host, running version MAIN 4.05, has 389-ds-base packages installed that are affected by a vulnerability: - It was found that 389-ds-base did not properly handle long search filters with characters needing escapes, possibly leading to buffer overflows. A remote,...

Amazon Linux 2 : 389-ds-base (ALAS-2019-1262)

It was found that encrypted connections did not honor the 'ioblocktimeout' parameter to end blocking requests. As a result, an unauthenticated attacker could repeatedly start a sufficient number of encrypted connections to block all workers, resulting in a denial of service. CVE-2019-3883 C Tenab...

Oracle Linux 7 : 389-ds-base (ELSA-2019-1896)

The remote Oracle Linux 7 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2019-1896 advisory. - Resolves: Bug 1719720 - CVE-2019-3883 389-ds-base: DoS via hanging secured connections Tenable has extracted the preceding description block directly from the...