Detections
Analytics
Amazon Linux AMI : 389-ds-base (ALAS-2020-1334)
high Nessus Plugin ID 133004
Language:
Synopsis
The remote Amazon Linux AMI host is missing a security update.Description
389-ds-base before versions 1.3.8.5, 1.4.0.12 is vulnerable to a Cleartext Storage of Sensitive Information. By default, when the Replica and/or retroChangeLog plugins are enabled, 389-ds-base stores passwords in plaintext format in their respective changelog files. An attacker with sufficiently high privileges, such as root or Directory Manager, can query these files in order to retrieve plaintext passwords.(CVE-2018-10871)A flaw has been found in 389-ds-base versions 1.4.x.x before 1.4.1.3.
When executed in verbose mode, the dscreate and dsconf commands may display sensitive information, such as the Directory Manager password.
An attacker, able to see the screen or record the terminal standard error output, could use this flaw to gain sensitive information.(CVE-2019-10224)
A flaw was found in the 'deref' plugin of 389-ds-base where it could use the 'search' permission to display attribute values. In some configurations, this could allow an authenticated attacker to view private attributes, such as password hashes.(CVE-2019-14824)
In 389-ds-base up to version 1.4.1.2, requests are handled by workers threads. Each sockets will be waited by the worker for at most 'ioblocktimeout' seconds. However this timeout applies only for un-encrypted requests. Connections using SSL/TLS are not taking this timeout into account during reads, and may hang longer.An unauthenticated attacker could repeatedly create hanging LDAP requests to hang all the workers, resulting in a Denial of Service.(CVE-2019-3883)
It was found that encrypted connections did not honor the 'ioblocktimeout' parameter to end blocking requests. As a result, an unauthenticated attacker could repeatedly start a sufficient number of encrypted connections to block all workers, resulting in a denial of service.(CVE-2019-3883)
Solution
Run 'yum update 389-ds-base' to update your system.See Also
Plugin Details
Severity: High
ID: 133004
File Name: ala_ALAS-2020-1334.nasl
Version: 1.2
Type: local
Agent: unix
Published: 1/17/2020
Updated: 1/21/2020
Supported Sensors: Frictionless Assessment AWS, Frictionless Assessment Agent, Nessus Agent, Agentless Assessment, Nessus
Risk Information
VPR
Risk Factor: Medium
Score: 5.9
CVSS v2
Risk Factor: Medium
Base Score: 4
Temporal Score: 3
Vector: CVSS2#AV:N/AC:L/Au:S/C:P/I:N/A:N
CVSS Score Source: CVE-2018-10871
CVSS v3
Risk Factor: High
Base Score: 7.2
Temporal Score: 6.3
Vector: CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C
Vulnerability Information
CPE: p-cpe:/a:amazon:linux:389-ds-base, p-cpe:/a:amazon:linux:389-ds-base-debuginfo, p-cpe:/a:amazon:linux:389-ds-base-devel, p-cpe:/a:amazon:linux:389-ds-base-libs, p-cpe:/a:amazon:linux:389-ds-base-snmp, cpe:/o:amazon:linux
Required KB Items: Host/local_checks_enabled, Host/AmazonLinux/release, Host/AmazonLinux/rpm-list
Exploit Ease: No known exploits are available
Patch Publication Date: 1/15/2020
Vulnerability Publication Date: 7/18/2018
Reference Information
CVE: CVE-2018-10871, CVE-2019-10224, CVE-2019-14824, CVE-2019-3883
ALAS: 2020-1334