A flaw was found in 389-ds-base. If an asterisk is imported as password hashes, either accidentally or maliciously, then instead of being inactive, any password will successfully match during authentication. This flaw allows an attacker to successfully authenticate as a user whose password was disabled.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2021:3955 advisory.

    Red Hat Directory Server is an LDAPv3-compliant directory server. The suite of packages includes the     Lightweight Directory Access Protocol (LDAP) server, as well as command-line utilities and Web UI packages     for server administration.

    This release provides a number of security fixes, bug fixes and enhancements. For detailed information on     changes in this release, see the Red Hat Directory Server 11 Release Notes linked from the References     section.

    Security Fix(es):

    * 389-ds-base: CRYPT password hash with asterisk allows any bind attempt to succeed (CVE-2021-3652)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

    Users of Red Hat Directory Server 11 are advised to upgrade to these updated packages.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Rocky Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RLSA-2021:3079 advisory.

  - A flaw was found in 389-ds-base. If an asterisk is imported as password hashes, either accidentally or     maliciously, then instead of being inactive, any password will successfully match during authentication.
    This flaw allows an attacker to successfully authenticate as a user whose password was disabled.
    (CVE-2021-3652)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Debian 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the dla-3399 advisory.

  - A flaw has been found in 389-ds-base versions 1.4.x.x before 1.4.1.3. When executed in verbose mode, the     dscreate and dsconf commands may display sensitive information, such as the Directory Manager password. An     attacker, able to see the screen or record the terminal standard error output, could use this flaw to gain     sensitive information. (CVE-2019-10224)

  - A flaw was found in the 'deref' plugin of 389-ds-base where it could use the 'search' permission to     display attribute values. In some configurations, this could allow an authenticated attacker to view     private attributes, such as password hashes. (CVE-2019-14824)

  - In 389-ds-base up to version 1.4.1.2, requests are handled by workers threads. Each sockets will be waited     by the worker for at most 'ioblocktimeout' seconds. However this timeout applies only for un-encrypted     requests. Connections using SSL/TLS are not taking this timeout into account during reads, and may hang     longer.An unauthenticated attacker could repeatedly create hanging LDAP requests to hang all the workers,     resulting in a Denial of Service. (CVE-2019-3883)

  - When using a sync_repl client in 389-ds-base, an authenticated attacker can cause a NULL pointer     dereference using a specially crafted query, causing a crash. (CVE-2021-3514)

  - A flaw was found in 389-ds-base. If an asterisk is imported as password hashes, either accidentally or     maliciously, then instead of being inactive, any password will successfully match during authentication.
    This flaw allows an attacker to successfully authenticate as a user whose password was disabled.
    (CVE-2021-3652)

  - A double-free was found in the way 389-ds-base handles virtual attributes context in persistent searches.
    An attacker could send a series of search requests, forcing the server to behave unexpectedly, and crash.
    (CVE-2021-4091)

  - A vulnerability was discovered in the 389 Directory Server that allows an unauthenticated attacker with     network access to the LDAP port to cause a denial of service. The denial of service is triggered by a     single message sent over a TCP connection, no bind or other authentication is required. The message     triggers a segmentation fault that results in slapd crashing. (CVE-2022-0918)

  - A vulnerability was found in the 389 Directory Server that allows expired passwords to access the database     to cause improper authentication. (CVE-2022-0996)

  - A flaw was found In 389-ds-base. When the Content Synchronization plugin is enabled, an authenticated user     can reach a NULL pointer dereference using a specially crafted query. This flaw allows an authenticated     attacker to cause a denial of service. This CVE is assigned against an incomplete fix of CVE-2021-3514.
    (CVE-2022-2850)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

According to the versions of the 389-ds-base package installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

  - A flaw was found in 389-ds-base. If an asterisk is imported as password hashes, either accidentally or     maliciously, then instead of being inactive, any password will successfully match during authentication.
    This flaw allows an attacker to successfully authenticate as a user whose password was disabled.
    (CVE-2021-3652)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The version of 389-ds-base installed on the remote host is prior to 1.3.10.2-9.67. It is, therefore, affected by a vulnerability as referenced in the ALAS-2022-1620 advisory.

  - A flaw was found in 389-ds-base. If an asterisk is imported as password hashes, either accidentally or     maliciously, then instead of being inactive, any password will successfully match during authentication.
    This flaw allows an attacker to successfully authenticate as a user whose password was disabled.
    (CVE-2021-3652)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of 389-admin installed on the remote host is prior to 1.1.46-5.14. It is, therefore, affected by a vulnerability as referenced in the ALAS-2022-1619 advisory.

  - A flaw was found in 389-ds-base. If an asterisk is imported as password hashes, either accidentally or     maliciously, then instead of being inactive, any password will successfully match during authentication.
    This flaw allows an attacker to successfully authenticate as a user whose password was disabled.
    (CVE-2021-3652)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES15 / SLES_SAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2022:2163-1 advisory.

  - A flaw was found in 389-ds-base. If an asterisk is imported as password hashes, either accidentally or     maliciously, then instead of being inactive, any password will successfully match during authentication.
    This flaw allows an attacker to successfully authenticate as a user whose password was disabled.
    (CVE-2021-3652)

  - A double-free was found in the way 389-ds-base handles virtual attributes context in persistent searches.
    An attacker could send a series of search requests, forcing the server to behave unexpectedly, and crash.
    (CVE-2021-4091)

  - A vulnerability was discovered in the 389 Directory Server that allows an unauthenticated attacker with     network access to the LDAP port to cause a denial of service. The denial of service is triggered by a     single message sent over a TCP connection, no bind or other authentication is required. The message     triggers a segmentation fault that results in slapd crashing. (CVE-2022-0918)

  - A vulnerability was found in the 389 Directory Server that allows expired passwords to access the database     to cause improper authentication. (CVE-2022-0996)

  - An access control bypass vulnerability found in 389-ds-base. That mishandling of the filter that would     yield incorrect results, but as that has progressed, can be determined that it actually is an access     control bypass. This may allow any remote unauthenticated user to issue a filter that allows searching for     database items they do not have access to, including but not limited to potentially userPassword hashes     and other sensitive data. (CVE-2022-1949)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES15 / SLES_SAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2022:2109-1 advisory.

  - A flaw was found in 389-ds-base. If an asterisk is imported as password hashes, either accidentally or     maliciously, then instead of being inactive, any password will successfully match during authentication.
    This flaw allows an attacker to successfully authenticate as a user whose password was disabled.
    (CVE-2021-3652)

  - A double-free was found in the way 389-ds-base handles virtual attributes context in persistent searches.
    An attacker could send a series of search requests, forcing the server to behave unexpectedly, and crash.
    (CVE-2021-4091)

  - An access control bypass vulnerability found in 389-ds-base. That mishandling of the filter that would     yield incorrect results, but as that has progressed, can be determined that it actually is an access     control bypass. This may allow any remote unauthenticated user to issue a filter that allows searching for     database items they do not have access to, including but not limited to potentially userPassword hashes     and other sensitive data. (CVE-2022-1949)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

According to the versions of the 389-ds-base packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

  - A flaw was found in 389-ds-base. If an asterisk is imported as password hashes, either accidentally or     maliciously, then instead of being inactive, any password will successfully match during authentication.
    This flaw allows an attacker to successfully authenticate as a user whose password was disabled.
    (CVE-2021-3652)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The version of 389-ds-base installed on the remote host is prior to 1.3.10.2-13. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2021-1723 advisory.

  - A flaw was found in 389-ds-base. If an asterisk is imported as password hashes, either accidentally or     maliciously, then instead of being inactive, any password will successfully match during authentication.
    This flaw allows an attacker to successfully authenticate as a user whose password was disabled.
    (CVE-2021-3652)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 7 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2021:3807 advisory.

  - A flaw was found in 389-ds-base. If an asterisk is imported as password hashes, either accidentally or     maliciously, then instead of being inactive, any password will successfully match during authentication.
    This flaw allows an attacker to successfully authenticate as a user whose password was disabled.
    (CVE-2021-3652)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2021:3906 advisory.

    389 Directory Server is an LDAP version 3 (LDAPv3) compliant server. The base packages include the     Lightweight Directory Access Protocol (LDAP) server and command-line utilities for server administration.

    Security Fix(es):

    * 389-ds-base: CRYPT password hash with asterisk allows any bind attempt to succeed (CVE-2021-3652)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

    Bug Fix(es):

    * A replication connection can be erroneously flagged as a non-replication connection causing the     evaluation of the access control rules (BZ#1993267).

    * If a persistent search encounters an error entries were previously still being returned. This has been     fixed (BZ#1993266).

    * Indexes added by plugins are not enabled, and cause some plugins to perform unexpected internal     unindexed searches. Now indexes added by plugins are enabled immediately (BZ#1993263).

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Scientific Linux 7 host has packages installed that are affected by a vulnerability as referenced in the SLSA-2021:3807-1 advisory.

  - 389-ds-base: CRYPT password hash with asterisk allows any bind attempt to  succeed (CVE-2021-3652)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 7 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2021-3807 advisory.

    - Resolves: Bug 2005432 - CVE-2021-3652 389-ds:1.4/389-ds-base: CRYPT password hash with asterisk allows     any bind attempt to succeed

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2021:3807 advisory.

    389 Directory Server is an LDAP version 3 (LDAPv3) compliant server. The base packages include the     Lightweight Directory Access Protocol (LDAP) server and command-line utilities for server administration.

    Security Fix(es):

    * 389-ds-base: CRYPT password hash with asterisk allows any bind attempt to succeed (CVE-2021-3652)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

    Bug Fix(es):

    * A plugin can create an index. Even if the index can be used immediately (for     searches) the index remains offline until further reindex (BZ#2005399)

    * In some rare case, a replication connection may be treated as a regular connection and ACIs evaluated     even if they should not. (BZ#2005434)

    * A regular connection can be erroneously flagged replication connection (BZ#2005435)

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SUSE15 host has packages installed that are affected by a vulnerability as referenced in the openSUSE-SU-2021:1211-1 advisory.

  - 389-ds-base: CRYPT password hash with asterisk allows any bind attempt to succeed (CVE-2021-3652)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES15 host has packages installed that are affected by a vulnerability as referenced in the SUSE- SU-2021:2857-1 advisory.

  - A flaw was found in 389-ds-base. If an asterisk is imported as password hashes, either accidentally or     maliciously, then instead of being inactive, any password will successfully match during authentication.
    This flaw allows an attacker to successfully authenticate as a user whose password was disabled.
    (CVE-2021-3652)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SUSE15 host has packages installed that are affected by a vulnerability as referenced in the openSUSE-SU-2021:2801-1 advisory.

  - 389-ds-base: CRYPT password hash with asterisk allows any bind attempt to succeed (CVE-2021-3652)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES15 host has packages installed that are affected by a vulnerability as referenced in the SUSE- SU-2021:2801-1 advisory.

  - A flaw was found in 389-ds-base. If an asterisk is imported as password hashes, either accidentally or     maliciously, then instead of being inactive, any password will successfully match during authentication.
    This flaw allows an attacker to successfully authenticate as a user whose password was disabled.
    (CVE-2021-3652)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 8 host has packages installed that are affected by a vulnerability as referenced in the CESA-2021:3079 advisory.

  - 389-ds-base: CRYPT password hash with asterisk allows any bind attempt to succeed (CVE-2021-3652)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 8 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2021-3079 advisory.

    [1.4.3.16-19]
    - Bump version to 1.4.3.16-19
    - Resolve: Bug 1984091 - persistent search returns entries even when an error is returned by content-sync-     plugin

    [1.4.3.16-18]
    - Bump version to 1.4.3.16-18
    - Resolve: Bug 1983121 - CRYPT password hash with asterisk allows any bind attempt to succeed

    [1.4.3.16-17]
    - Bump version to 1.4.3.16-17
    - Resolve: Bug 1983095 - Internal unindexed searches in syncrepl
    - Resolve: Bug 1980063 - IPA installation fails on s390x with 389-ds-     base-1.4.3.8-4.module+el8.3.0+7193+dfd1e8ad.s390x

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2021:3079 advisory.

    389 Directory Server is an LDAP version 3 (LDAPv3) compliant server. The base packages include the     Lightweight Directory Access Protocol (LDAP) server and command-line utilities for server administration.

    Security Fix(es):

    * 389-ds-base: CRYPT password hash with asterisk allows any bind attempt to succeed (CVE-2021-3652)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

    Bug Fix(es):

    * A plugin can create an index. Even if the index can be used immediately (for searches) the index remains     offline until further reindex (BZ#1983095)

    * On big endian machine, the server fails to identify the operation type (BZ#1980063)

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
194190	RHEL 8 : redhat-ds:11 (RHSA-2021:3955)	Nessus	Red Hat Local Security Checks	medium
185025	Rocky Linux 8 : 389-ds:1.4 (RLSA-2021:3079)	Nessus	Rocky Linux Local Security Checks	medium
174722	Debian DLA-3399-1 : 389-ds-base - LTS security update	Nessus	Debian Local Security Checks	medium
164223	EulerOS 2.0 SP8 : 389-ds-base (EulerOS-SA-2022-2214)	Nessus	Huawei Local Security Checks	medium
163868	Amazon Linux AMI : 389-ds-base (ALAS-2022-1620)	Nessus	Amazon Linux Local Security Checks	medium
163864	Amazon Linux AMI : 389-admin (ALAS-2022-1619)	Nessus	Amazon Linux Local Security Checks	medium
162523	SUSE SLES15 Security Update : 389-ds (SUSE-SU-2022:2163-1)	Nessus	SuSE Local Security Checks	high
162386	SUSE SLES15 Security Update : 389-ds (SUSE-SU-2022:2109-1)	Nessus	SuSE Local Security Checks	high
158313	EulerOS 2.0 SP3 : 389-ds-base (EulerOS-SA-2022-1156)	Nessus	Huawei Local Security Checks	medium
156424	EulerOS 2.0 SP5 : 389-ds-base (EulerOS-SA-2021-2928)	Nessus	Huawei Local Security Checks	medium
155979	Amazon Linux 2 : 389-ds-base (ALAS-2021-1723)	Nessus	Amazon Linux Local Security Checks	medium
155553	CentOS 7 : 389-ds-base (RHSA-2021:3807)	Nessus	CentOS Local Security Checks	medium
154261	RHEL 8 : 389-ds:1.4 (RHSA-2021:3906)	Nessus	Red Hat Local Security Checks	medium
154130	Scientific Linux Security Update : 389-ds-base on SL7.x x86_64 (2021:3807)	Nessus	Scientific Linux Local Security Checks	medium
154085	Oracle Linux 7 : 389-ds-base (ELSA-2021-3807)	Nessus	Oracle Linux Local Security Checks	medium
154075	RHEL 7 : 389-ds-base (RHSA-2021:3807)	Nessus	Red Hat Local Security Checks	medium
152958	openSUSE 15 Security Update : 389-ds (openSUSE-SU-2021:1211-1)	Nessus	SuSE Local Security Checks	medium
152891	SUSE SLES15 Security Update : 389-ds (SUSE-SU-2021:2857-1)	Nessus	SuSE Local Security Checks	medium
152729	openSUSE 15 Security Update : 389-ds (openSUSE-SU-2021:2801-1)	Nessus	SuSE Local Security Checks	medium
152706	SUSE SLES15 Security Update : 389-ds (SUSE-SU-2021:2801-1)	Nessus	SuSE Local Security Checks	medium
152588	CentOS 8 : 389-ds:1.4 (CESA-2021:3079)	Nessus	CentOS Local Security Checks	medium
152511	Oracle Linux 8 : 389-ds:1.4 (ELSA-2021-3079)	Nessus	Oracle Linux Local Security Checks	medium
152450	RHEL 8 : 389-ds:1.4 (RHSA-2021:3079)	Nessus	Red Hat Local Security Checks	medium

Detections

Analytics

CVE-2021-3652

medium

Tenable Plugins

medium

medium

medium

medium

medium

medium

high

high

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium