When using a sync_repl client in 389-ds-base, an authenticated attacker can cause a NULL pointer dereference using a specially crafted query, causing a crash.

The remote Redhat Enterprise Linux 6 host has one or more packages installed that are affected by multiple vulnerabilities that have been acknowledged by the vendor but will not be patched.

  - 389-ds-base: Password brute-force possible for locked account due to different return codes     (CVE-2017-7551)

  - 389-ds-base: CRYPT password hash with asterisk allows any bind attempt to succeed (CVE-2021-3652)

  - 389-ds-base before versions 1.4.0.10, 1.3.8.3 is vulnerable to a race condition in the way 389-ds-base     handles persistent search, resulting in a crash if the server is under load. An anonymous attacker could     use this flaw to trigger a denial of service. (CVE-2018-10850)

  - 389-ds-base before versions 1.3.8.5, 1.4.0.12 is vulnerable to a Cleartext Storage of Sensitive     Information. By default, when the Replica and/or retroChangeLog plugins are enabled, 389-ds-base stores     passwords in plaintext format in their respective changelog files. An attacker with sufficiently high     privileges, such as root or Directory Manager, can query these files in order to retrieve plaintext     passwords. (CVE-2018-10871)

  - A vulnerability was discovered in 389-ds-base through versions 1.3.7.10, 1.3.8.8 and 1.4.0.16. The lock     controlling the error log was not correctly used when re-opening the log file in log__error_emergency().
    An attacker could send a flood of modifications to a very large DN, which would cause slapd to crash.
    (CVE-2018-14624)

  - A flaw was found in 389-ds-base before version 1.3.8.4-13. The process ns-slapd crashes in     delete_passwdPolicy function when persistent search connections are terminated unexpectedly leading to     remote denial of service. (CVE-2018-14638)

  - A flaw was found in 389 Directory Server. A specially crafted search query could lead to excessive CPU     consumption in the do_search() function. An unauthenticated attacker could use this flaw to provoke a     denial of service. (CVE-2018-14648)

  - A flaw was found in the 'deref' plugin of 389-ds-base where it could use the 'search' permission to     display attribute values. In some configurations, this could allow an authenticated attacker to view     private attributes, such as password hashes. (CVE-2019-14824)

  - In 389-ds-base up to version 1.4.1.2, requests are handled by workers threads. Each sockets will be waited     by the worker for at most 'ioblocktimeout' seconds. However this timeout applies only for un-encrypted     requests. Connections using SSL/TLS are not taking this timeout into account during reads, and may hang     longer.An unauthenticated attacker could repeatedly create hanging LDAP requests to hang all the workers,     resulting in a Denial of Service. (CVE-2019-3883)

  - When binding against a DN during authentication, the reply from 389-ds-base will be different whether the     DN exists or not. This can be used by an unauthenticated attacker to check the existence of an entry in     the LDAP database. (CVE-2020-35518)

  - When using a sync_repl client in 389-ds-base, an authenticated attacker can cause a NULL pointer     dereference using a specially crafted query, causing a crash. (CVE-2021-3514)

  - A vulnerability was discovered in the 389 Directory Server that allows an unauthenticated attacker with     network access to the LDAP port to cause a denial of service. The denial of service is triggered by a     single message sent over a TCP connection, no bind or other authentication is required. The message     triggers a segmentation fault that results in slapd crashing. (CVE-2022-0918)

  - A vulnerability was found in the 389 Directory Server that allows expired passwords to access the database     to cause improper authentication. (CVE-2022-0996)

  - An access control bypass vulnerability found in 389-ds-base. That mishandling of the filter that would     yield incorrect results, but as that has progressed, can be determined that it actually is an access     control bypass. This may allow any remote unauthenticated user to issue a filter that allows searching for     database items they do not have access to, including but not limited to potentially userPassword hashes     and other sensitive data. (CVE-2022-1949)

  - A flaw was found In 389-ds-base. When the Content Synchronization plugin is enabled, an authenticated user     can reach a NULL pointer dereference using a specially crafted query. This flaw allows an authenticated     attacker to cause a denial of service. This CVE is assigned against an incomplete fix of CVE-2021-3514.
    (CVE-2022-2850)

  - A heap overflow flaw was found in 389-ds-base. This issue leads to a denial of service when writing a     value larger than 256 chars in log_entry_attr. (CVE-2024-1062)

Note that Nessus has not tested for these issues but has instead relied on the package manager's report that the package is installed.

The remote Redhat Enterprise Linux 7 host has one or more packages installed that are affected by multiple vulnerabilities that have been acknowledged by the vendor but will not be patched.

  - 389-ds-base: access control bypass by query (filter in LDAP terms) optimiser (CVE-2022-1949)

  - 389-ds-base before versions 1.3.8.5, 1.4.0.12 is vulnerable to a Cleartext Storage of Sensitive     Information. By default, when the Replica and/or retroChangeLog plugins are enabled, 389-ds-base stores     passwords in plaintext format in their respective changelog files. An attacker with sufficiently high     privileges, such as root or Directory Manager, can query these files in order to retrieve plaintext     passwords. (CVE-2018-10871)

  - When using a sync_repl client in 389-ds-base, an authenticated attacker can cause a NULL pointer     dereference using a specially crafted query, causing a crash. (CVE-2021-3514)

  - A heap overflow flaw was found in 389-ds-base. This issue leads to a denial of service when writing a     value larger than 256 chars in log_entry_attr. (CVE-2024-1062)

Note that Nessus has not tested for these issues but has instead relied on the package manager's report that the package is installed.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2022:0952 advisory.

  - 389-ds-base: sync_repl NULL pointer dereference in sync_create_state_control() (CVE-2021-3514)

  - 389-ds-base: double free of the virtual attribute context in persistent search (CVE-2021-4091)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2021:3955 advisory.

  - 389-ds-base: sync_repl NULL pointer dereference in sync_create_state_control() (CVE-2021-3514)

  - 389-ds-base: CRYPT password hash with asterisk allows any bind attempt to succeed (CVE-2021-3652)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Ubuntu 16.04 ESM / 18.04 ESM / 20.04 ESM host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-5231-1 advisory.

  - When binding against a DN during authentication, the reply from 389-ds-base will be different whether the     DN exists or not. This can be used by an unauthenticated attacker to check the existence of an entry in     the LDAP database. (CVE-2020-35518)

  - When using a sync_repl client in 389-ds-base, an authenticated attacker can cause a NULL pointer     dereference using a specially crafted query, causing a crash. (CVE-2021-3514)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Debian 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the dla-3399 advisory.

  - A flaw has been found in 389-ds-base versions 1.4.x.x before 1.4.1.3. When executed in verbose mode, the     dscreate and dsconf commands may display sensitive information, such as the Directory Manager password. An     attacker, able to see the screen or record the terminal standard error output, could use this flaw to gain     sensitive information. (CVE-2019-10224)

  - A flaw was found in the 'deref' plugin of 389-ds-base where it could use the 'search' permission to     display attribute values. In some configurations, this could allow an authenticated attacker to view     private attributes, such as password hashes. (CVE-2019-14824)

  - In 389-ds-base up to version 1.4.1.2, requests are handled by workers threads. Each sockets will be waited     by the worker for at most 'ioblocktimeout' seconds. However this timeout applies only for un-encrypted     requests. Connections using SSL/TLS are not taking this timeout into account during reads, and may hang     longer.An unauthenticated attacker could repeatedly create hanging LDAP requests to hang all the workers,     resulting in a Denial of Service. (CVE-2019-3883)

  - When using a sync_repl client in 389-ds-base, an authenticated attacker can cause a NULL pointer     dereference using a specially crafted query, causing a crash. (CVE-2021-3514)

  - A flaw was found in 389-ds-base. If an asterisk is imported as password hashes, either accidentally or     maliciously, then instead of being inactive, any password will successfully match during authentication.
    This flaw allows an attacker to successfully authenticate as a user whose password was disabled.
    (CVE-2021-3652)

  - A double-free was found in the way 389-ds-base handles virtual attributes context in persistent searches.
    An attacker could send a series of search requests, forcing the server to behave unexpectedly, and crash.
    (CVE-2021-4091)

  - A vulnerability was discovered in the 389 Directory Server that allows an unauthenticated attacker with     network access to the LDAP port to cause a denial of service. The denial of service is triggered by a     single message sent over a TCP connection, no bind or other authentication is required. The message     triggers a segmentation fault that results in slapd crashing. (CVE-2022-0918)

  - A vulnerability was found in the 389 Directory Server that allows expired passwords to access the database     to cause improper authentication. (CVE-2022-0996)

  - A flaw was found In 389-ds-base. When the Content Synchronization plugin is enabled, an authenticated user     can reach a NULL pointer dereference using a specially crafted query. This flaw allows an authenticated     attacker to cause a denial of service. This CVE is assigned against an incomplete fix of CVE-2021-3514.
    (CVE-2022-2850)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Rocky Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RLSA-2021:2595 advisory.

  - When using a sync_repl client in 389-ds-base, an authenticated attacker can cause a NULL pointer     dereference using a specially crafted query, causing a crash. (CVE-2021-3514)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2021:2796 advisory.

  - 389-ds-base: sync_repl NULL pointer dereference in sync_create_state_control() (CVE-2021-3514)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 8 host has packages installed that are affected by a vulnerability as referenced in the CESA-2021:2595 advisory.

  - 389-ds-base: sync_repl NULL pointer dereference in sync_create_state_control() (CVE-2021-3514)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 8 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2021-2595 advisory.

  - When using a sync_repl client in 389-ds-base, an authenticated attacker can cause a NULL pointer     dereference using a specially crafted query, causing a crash. (CVE-2021-3514)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2021:2595 advisory.

  - 389-ds-base: sync_repl NULL pointer dereference in sync_create_state_control() (CVE-2021-3514)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

This update for 389-ds fixes the following issues :

  - CVE-2021-3514: Fixed a sync_repl NULL pointer     dereference in sync_create_state_control() (bsc#1185356)

389-ds was updated to version 1.4.3.23~git0.f53d0132b :

Bump version to 1.4.3.23 :

  - Issue 4725 - [RFE] DS - Update the password policy to     support a Temporary Password Rules (#4727)

  - Issue 4759 - Fix coverity issue (#4760)

  - Issue 4656 - Fix cherry pick error around replication     enabling

  - Issue 4701 - RFE - Exclude attributes from retro     changelog (#4723) (#4746)

  - Issue 4742 - UI - should always use LDAPI path when     calling CLI

  - Issue 4667 - incorrect accounting of readers in vattr     rwlock (#4732)

  - Issue 4711 - SIGSEV with sync_repl (#4738)

  - Issue 4649 - fix testcase importing ContentSyncPlugin

  - Issue 2736 - Warnings from automatic shebang munging     macro

  - Issue 2736 -     https://github.com/389ds/389-ds-base/issues/2736

  - Issue 4706 - negative wtime in access log for CMP     operations

Bump version to 1.4.3.22 :

  - Issue 4671 - UI - Fix browser crashes

  - lib389 - Add ContentSyncPlugin class

  - Issue 4656 - lib389 - fix cherry pick error

  - Issue 4229 - Fix Rust linking

  - Issue 4658 - monitor - connection start date is     incorrect

  - Issue 2621 - lib389 - backport     ds_supports_new_changelog()

  - Issue 4656 - Make replication CLI backwards compatible     with role name change

  - Issue 4656 - Remove problematic language from     UI/CLI/lib389

  - Issue 4459 - lib389 - Default paths should use dse.ldif     if the server is down

  - Issue 4663 - CLI - unable to add objectclass/attribute     without x-origin

Bump version to 1.4.3.21 :

  - Issue 4169 - UI - updates on the tuning page are not     reflected in the UI

  - Issue 4588 - BUG - unable to compile without xcrypt     (#4589)

  - Issue 4513 - Fix replication CI test failures (#4557)

  - Issue 4646 - CLI/UI - revise DNA plugin management

  - Issue 4644 - Large updates can reset the CLcache to the     beginning of the changelog (#4647)

  - Issue 4649 - crash in sync_repl when a MODRDN create a     cenotaph (#4652)

  - Issue 4615 - log message when psearch first exceeds max     threads per conn

Bump version to 1.4.3.20 :

  - Issue 4324 - Some architectures the cache line size file     does not exist

  - Issue 4593 - RFE - Print help when nsSSLPersonalitySSL     is not found (#4614)

This update was imported from the SUSE:SLE-15-SP2:Update update project.

The remote SUSE Linux SLES15 host has packages installed that are affected by a vulnerability as referenced in the SUSE- SU-2021:1878-1 advisory.

  - When using a sync_repl client in 389-ds-base, an authenticated attacker can cause a NULL pointer     dereference using a specially crafted query, causing a crash. (CVE-2021-3514)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
196299	RHEL 6 : 389-ds-base (Unpatched Vulnerability)	Nessus	Red Hat Local Security Checks	critical
196258	RHEL 7 : 389-ds-base (Unpatched Vulnerability)	Nessus	Red Hat Local Security Checks	high
194281	RHEL 8 : redhat-ds:11.3 (RHSA-2022:0952)	Nessus	Red Hat Local Security Checks	high
194190	RHEL 8 : redhat-ds:11 (RHSA-2021:3955)	Nessus	Red Hat Local Security Checks	medium
183133	Ubuntu 16.04 ESM / 18.04 ESM / 20.04 ESM : 389 Directory Server vulnerabilities (USN-5231-1)	Nessus	Ubuntu Local Security Checks	medium
174722	Debian DLA-3399-1 : 389-ds-base - LTS security update	Nessus	Debian Local Security Checks	medium
157763	Rocky Linux 8 : 389-ds:1.4 (RLSA-2021:2595)	Nessus	Rocky Linux Local Security Checks	medium
151849	RHEL 8 : 389-ds:1.4 (RHSA-2021:2796)	Nessus	Red Hat Local Security Checks	medium
151366	CentOS 8 : 389-ds:1.4 (CESA-2021:2595)	Nessus	CentOS Local Security Checks	medium
151353	Oracle Linux 8 : 389-ds:1.4 (ELSA-2021-2595)	Nessus	Oracle Linux Local Security Checks	medium
151153	RHEL 8 : 389-ds:1.4 (RHSA-2021:2595)	Nessus	Red Hat Local Security Checks	medium
150754	openSUSE Security Update : 389-ds (openSUSE-2021-868)	Nessus	SuSE Local Security Checks	medium
150400	SUSE SLES15 Security Update : 389-ds (SUSE-SU-2021:1878-1)	Nessus	SuSE Local Security Checks	medium

Detections

Analytics

CVE-2021-3514

medium

Tenable Plugins

critical

high

high

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium