When using a sync_repl client in 389-ds-base, an authenticated attacker can cause a NULL pointer dereference using a specially crafted query, causing a crash.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2022:0952 advisory.

    Red Hat Directory Server is an LDAPv3-compliant directory server. The suite of     packages includes the Lightweight Directory Access Protocol (LDAP) server, as     well as command-line utilities and Web UI packages for server administration.

    Security Fix(es):

    * 389-ds-base: sync_repl NULL pointer dereference in sync_create_state_control() (CVE-2021-3514)

    * 389-ds-base: double-free of the virtual attribute context in persistent search (CVE-2021-4091)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

    Bug Fix(es):

    * ACIs are being evaluated against the Replication Manager account in a replication context. (BZ#2022086)

    * A connection can be erroneously flagged as replication conn during evaluation of an aci with ip bind     rule (BZ#2022090)

    * DB corruption _entryrdn_insert_key - Same DN (dn: nsuniqueid=ffffffff-ffffffff-ffffffff-     ffffffff,<SUFFIX>) is already in the entryrdn file (BZ#2022686)

    * CLI needs option to set nsslapd-state (BZ#2040794)

    Users of Red Hat Directory Server 11 are advised to install these updated     packages.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2021:3955 advisory.

    Red Hat Directory Server is an LDAPv3-compliant directory server. The suite of packages includes the     Lightweight Directory Access Protocol (LDAP) server, as well as command-line utilities and Web UI packages     for server administration.

    This release provides a number of security fixes, bug fixes and enhancements. For detailed information on     changes in this release, see the Red Hat Directory Server 11 Release Notes linked from the References     section.

    Security Fix(es):

    * 389-ds-base: CRYPT password hash with asterisk allows any bind attempt to succeed (CVE-2021-3652)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

    Users of Red Hat Directory Server 11 are advised to upgrade to these updated packages.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Ubuntu 16.04 ESM / 18.04 ESM / 20.04 ESM host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-5231-1 advisory.

    It was discovered that 389 Directory Server presented to users, during authentication, an error message     which could be used to discover if a certain LDAP DN existed or not. A remote unauthenticated attacker     could possibly use this to check the existence of an entry in a LDAP database and expose sensitive     information. This issue affected only Ubuntu 20.04 ESM. (CVE-2020-35518)

    It was discovered that 389 Directory Server was incorrectly validating data used to access memory     addresses. An authenticated attacker using a Syncrepl client could use this issue with a specially crafted     query to cause 389 Directory Server to crash, resulting in a denial of service. (CVE-2021-3514)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Debian 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the dla-3399 advisory.

  - A flaw has been found in 389-ds-base versions 1.4.x.x before 1.4.1.3. When executed in verbose mode, the     dscreate and dsconf commands may display sensitive information, such as the Directory Manager password. An     attacker, able to see the screen or record the terminal standard error output, could use this flaw to gain     sensitive information. (CVE-2019-10224)

  - A flaw was found in the 'deref' plugin of 389-ds-base where it could use the 'search' permission to     display attribute values. In some configurations, this could allow an authenticated attacker to view     private attributes, such as password hashes. (CVE-2019-14824)

  - In 389-ds-base up to version 1.4.1.2, requests are handled by workers threads. Each sockets will be waited     by the worker for at most 'ioblocktimeout' seconds. However this timeout applies only for un-encrypted     requests. Connections using SSL/TLS are not taking this timeout into account during reads, and may hang     longer.An unauthenticated attacker could repeatedly create hanging LDAP requests to hang all the workers,     resulting in a Denial of Service. (CVE-2019-3883)

  - When using a sync_repl client in 389-ds-base, an authenticated attacker can cause a NULL pointer     dereference using a specially crafted query, causing a crash. (CVE-2021-3514)

  - A flaw was found in 389-ds-base. If an asterisk is imported as password hashes, either accidentally or     maliciously, then instead of being inactive, any password will successfully match during authentication.
    This flaw allows an attacker to successfully authenticate as a user whose password was disabled.
    (CVE-2021-3652)

  - A double-free was found in the way 389-ds-base handles virtual attributes context in persistent searches.
    An attacker could send a series of search requests, forcing the server to behave unexpectedly, and crash.
    (CVE-2021-4091)

  - A vulnerability was discovered in the 389 Directory Server that allows an unauthenticated attacker with     network access to the LDAP port to cause a denial of service. The denial of service is triggered by a     single message sent over a TCP connection, no bind or other authentication is required. The message     triggers a segmentation fault that results in slapd crashing. (CVE-2022-0918)

  - A vulnerability was found in the 389 Directory Server that allows expired passwords to access the database     to cause improper authentication. (CVE-2022-0996)

  - A flaw was found In 389-ds-base. When the Content Synchronization plugin is enabled, an authenticated user     can reach a NULL pointer dereference using a specially crafted query. This flaw allows an authenticated     attacker to cause a denial of service. This CVE is assigned against an incomplete fix of CVE-2021-3514.
    (CVE-2022-2850)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Rocky Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RLSA-2021:2595 advisory.

  - When using a sync_repl client in 389-ds-base, an authenticated attacker can cause a NULL pointer     dereference using a specially crafted query, causing a crash. (CVE-2021-3514)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2021:2796 advisory.

    389 Directory Server is an LDAP version 3 (LDAPv3) compliant server. The base packages include the     Lightweight Directory Access Protocol (LDAP) server and command-line utilities for server administration.

    Security Fix(es):

    * 389-ds-base: sync_repl NULL pointer dereference in sync_create_state_control() (CVE-2021-3514)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 8 host has packages installed that are affected by a vulnerability as referenced in the CESA-2021:2595 advisory.

  - 389-ds-base: sync_repl NULL pointer dereference in sync_create_state_control() (CVE-2021-3514)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 8 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2021-2595 advisory.

    [1.4.3.16-16]
    - Bump version to 1.4.3.16-16
    - Resolves: Bug 1972738 - Changelog cache can upload updates from a wrong starting point (CSN)
    - Resolves: Bug 1972721 - Large updates can reset the CLcache to the beginning of the changelog

    [1.4.3.16-15]
    - Bump version to 1.4.3.16-15
    - Resolves: Bug 1970791 - A connection can be erroneously flagged as replication conn during evaluation of     an aci with ip bind rule

    [1.4.3.16-14]
    - Bump version to 1.4.3.16-14
    - Resolves: Bug 1968588 - ACIs are being evaluated against the Replication Manager account in a     replication context
    - Resolves: Bug 1960720 - sync_repl NULL pointer dereference in sync_create_state_control()

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2021:2595 advisory.

    389 Directory Server is an LDAP version 3 (LDAPv3) compliant server. The base packages include the     Lightweight Directory Access Protocol (LDAP) server and command-line utilities for server administration.

    Security Fix(es):

    * 389-ds-base: sync_repl NULL pointer dereference in sync_create_state_control() (CVE-2021-3514)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

    Bug Fix(es):

    * ACIs are being evaluated against the Replication Manager account in a replication context. (BZ#1968588)

    * A connection can be erroneously flagged as replication conn during evaluation of an aci with ip bind     rule (BZ#1970791)

    * Large updates can reset the CLcache to the beginning of the changelog (BZ#1972721)

    * Changelog cache can upload updates from a wrong starting point (CSN) (BZ#1972738)

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

This update for 389-ds fixes the following issues :

  - CVE-2021-3514: Fixed a sync_repl NULL pointer     dereference in sync_create_state_control() (bsc#1185356)

389-ds was updated to version 1.4.3.23~git0.f53d0132b :

Bump version to 1.4.3.23 :

  - Issue 4725 - [RFE] DS - Update the password policy to     support a Temporary Password Rules (#4727)

  - Issue 4759 - Fix coverity issue (#4760)

  - Issue 4656 - Fix cherry pick error around replication     enabling

  - Issue 4701 - RFE - Exclude attributes from retro     changelog (#4723) (#4746)

  - Issue 4742 - UI - should always use LDAPI path when     calling CLI

  - Issue 4667 - incorrect accounting of readers in vattr     rwlock (#4732)

  - Issue 4711 - SIGSEV with sync_repl (#4738)

  - Issue 4649 - fix testcase importing ContentSyncPlugin

  - Issue 2736 - Warnings from automatic shebang munging     macro

  - Issue 2736 -     https://github.com/389ds/389-ds-base/issues/2736

  - Issue 4706 - negative wtime in access log for CMP     operations

Bump version to 1.4.3.22 :

  - Issue 4671 - UI - Fix browser crashes

  - lib389 - Add ContentSyncPlugin class

  - Issue 4656 - lib389 - fix cherry pick error

  - Issue 4229 - Fix Rust linking

  - Issue 4658 - monitor - connection start date is     incorrect

  - Issue 2621 - lib389 - backport     ds_supports_new_changelog()

  - Issue 4656 - Make replication CLI backwards compatible     with role name change

  - Issue 4656 - Remove problematic language from     UI/CLI/lib389

  - Issue 4459 - lib389 - Default paths should use dse.ldif     if the server is down

  - Issue 4663 - CLI - unable to add objectclass/attribute     without x-origin

Bump version to 1.4.3.21 :

  - Issue 4169 - UI - updates on the tuning page are not     reflected in the UI

  - Issue 4588 - BUG - unable to compile without xcrypt     (#4589)

  - Issue 4513 - Fix replication CI test failures (#4557)

  - Issue 4646 - CLI/UI - revise DNA plugin management

  - Issue 4644 - Large updates can reset the CLcache to the     beginning of the changelog (#4647)

  - Issue 4649 - crash in sync_repl when a MODRDN create a     cenotaph (#4652)

  - Issue 4615 - log message when psearch first exceeds max     threads per conn

Bump version to 1.4.3.20 :

  - Issue 4324 - Some architectures the cache line size file     does not exist

  - Issue 4593 - RFE - Print help when nsSSLPersonalitySSL     is not found (#4614)

This update was imported from the SUSE:SLE-15-SP2:Update update project.

The remote SUSE Linux SLES15 host has packages installed that are affected by a vulnerability as referenced in the SUSE- SU-2021:1878-1 advisory.

  - When using a sync_repl client in 389-ds-base, an authenticated attacker can cause a NULL pointer     dereference using a specially crafted query, causing a crash. (CVE-2021-3514)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
194281	RHEL 8 : redhat-ds:11.3 (RHSA-2022:0952)	Nessus	Red Hat Local Security Checks	high
194190	RHEL 8 : redhat-ds:11 (RHSA-2021:3955)	Nessus	Red Hat Local Security Checks	medium
183133	Ubuntu 16.04 ESM / 18.04 ESM / 20.04 ESM : 389 Directory Server vulnerabilities (USN-5231-1)	Nessus	Ubuntu Local Security Checks	medium
174722	Debian DLA-3399-1 : 389-ds-base - LTS security update	Nessus	Debian Local Security Checks	medium
157763	Rocky Linux 8 : 389-ds:1.4 (RLSA-2021:2595)	Nessus	Rocky Linux Local Security Checks	medium
151849	RHEL 8 : 389-ds:1.4 (RHSA-2021:2796)	Nessus	Red Hat Local Security Checks	medium
151366	CentOS 8 : 389-ds:1.4 (CESA-2021:2595)	Nessus	CentOS Local Security Checks	medium
151353	Oracle Linux 8 : 389-ds:1.4 (ELSA-2021-2595)	Nessus	Oracle Linux Local Security Checks	medium
151153	RHEL 8 : 389-ds:1.4 (RHSA-2021:2595)	Nessus	Red Hat Local Security Checks	medium
150754	openSUSE Security Update : 389-ds (openSUSE-2021-868)	Nessus	SuSE Local Security Checks	medium
150400	SUSE SLES15 Security Update : 389-ds (SUSE-SU-2021:1878-1)	Nessus	SuSE Local Security Checks	medium

Detections

Analytics

CVE-2021-3514

medium

Tenable Plugins

high

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium