389-ds-base: password hashing bypassed when "nsslapd-unhashed-pw-switch" is set to off

It was found that when the nsslapd-unhashed-pw-switch 389 Directory Server configuration option was set to "off", it did not prevent the writing of unhashed passwords into the Changelog. This could potentially allow an authenticated user able to access the Changelog to read sensitive information...

Important: Red Hat Security Advisory: 389-ds-base security, bug fix, and enhancement update

Updated 389-ds-base packages that fix two security issues, several bugs, and add various enhancements are now available for Red Hat Enterprise Linux 7. Red Hat Product Security has rated this update as having Important security impact. Common Vulnerability Scoring System CVSS base scores, which...

RHEL 7 : 389-ds-base (RHSA-2015:0416)

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2015:0416 advisory. The 389 Directory Server is an LDAPv3 compliant server. The base packages include the Lightweight Directory Access Protocol LDAP server and...

UBUNTU-CVE-2012-2678

389 Directory Server before 1.2.11.6 aka Red Hat Directory Server before 8.2.10-3, after the password for a LDAP user has been changed and before the server has been reset, allows remote attackers to read the plaintext password via the unhasheduserpassword attribute...

Imail Cookie Vulnerability (unhashed)

Neither Regular or secure mode of Imail properly give out a hash on cookies leaving the cookies straight readable to any onlookers. No exploit is needed POC: "IMailUserId 1006332dgd2@Someserver" -------------------------- "IMailpassword 1234" Straight From Cookie ^^ edited to protect user Shoutz ...