389-ds-base before version 1.3.6 is vulnerable to an improperly NULL terminated array in the uniqueness_entry_to_config() function in the "attribute uniqueness" plugin of 389 Directory Server. An authenticated, or possibly unauthenticated, attacker could use this flaw to force an out-of-bound heap memory read, possibly triggering a crash of the LDAP service.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - 389-ds-base before version 1.3.6 is vulnerable to an improperly NULL terminated array in the     uniqueness_entry_to_config() function in the attribute uniqueness plugin of 389 Directory Server. An     authenticated, or possibly unauthenticated, attacker could use this flaw to force an out-of-bound heap     memory read, possibly triggering a crash of the LDAP service. (CVE-2017-2591)

Note that Nessus relies on the presence of the package as reported by the vendor.

According to the versions of the 389-ds-base packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

  - It was found that 389-ds-base did not properly handle     long search filters with characters needing escapes,     possibly leading to buffer overflows. A remote,     unauthenticated attacker could potentially use this     flaw to make ns-slapd crash via a specially crafted     LDAP request, thus resulting in denial of     service.(CVE-2018-1089)

  - It was found that the uniqueness_entry_to_config()     function, used by the 'attribute uniqueness' plugin of     389 Directory Server, did not properly NULL terminate     an array used in some configuration. An authenticated,     or possibly unauthenticated, attacker could use this     flaw to force an out-of-bound heap memory read,     possibly triggering a crash of the LDAP     service.(CVE-2017-2591)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update for 389-ds fixes the following issues :

  - CVE-2017-7551: 389-ds-base: Password brute-force     possible for locked account due to different return     codes (bsc#1051997)

  - CVE-2016-4992: 389-ds: Information disclosure via     repeated use of LDAP ADD operation (bsc#997256)

  - CVE-2016-5405: 389-ds: Password verification vulnerable     to timing attack (bsc#1007004)

  - CVE-2017-2591: 389-ds-base: Heap buffer overflow in     uiduniq.c (bsc#1020670)

  - CVE-2017-2668 389-ds Remote crash via crafted LDAP     messages (bsc#1069067)

  - CVE-2016-0741: 389-ds: worker threads do not detect     abnormally closed connections causing DoS (bsc#1069074)

ID	Name	Product	Family	Type	Severity
221121	Linux Distros Unpatched Vulnerability : CVE-2017-2591	Nessus	Misc.	Local	high
110854	EulerOS 2.0 SP2 : 389-ds-base (EulerOS-SA-2018-1190)	Nessus	Huawei Local Security Checks	Local	high
105366	openSUSE Security Update : 389-ds (openSUSE-2017-1396)	Nessus	SuSE Local Security Checks	Local	critical

Detections

Analytics

CVE-2017-2591

high

Tenable Plugins

high

high

critical