A double-free was found in the way 389-ds-base handles virtual attributes context in persistent searches. An attacker could send a series of search requests, forcing the server to behave unexpectedly, and crash.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2022:0952 advisory.

    Red Hat Directory Server is an LDAPv3-compliant directory server. The suite of     packages includes the Lightweight Directory Access Protocol (LDAP) server, as     well as command-line utilities and Web UI packages for server administration.

    Security Fix(es):

    * 389-ds-base: sync_repl NULL pointer dereference in sync_create_state_control() (CVE-2021-3514)

    * 389-ds-base: double-free of the virtual attribute context in persistent search (CVE-2021-4091)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

    Bug Fix(es):

    * ACIs are being evaluated against the Replication Manager account in a replication context. (BZ#2022086)

    * A connection can be erroneously flagged as replication conn during evaluation of an aci with ip bind     rule (BZ#2022090)

    * DB corruption _entryrdn_insert_key - Same DN (dn: nsuniqueid=ffffffff-ffffffff-ffffffff-     ffffffff,<SUFFIX>) is already in the entryrdn file (BZ#2022686)

    * CLI needs option to set nsslapd-state (BZ#2040794)

    Users of Red Hat Directory Server 11 are advised to install these updated     packages.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Rocky Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RLSA-2022:0889 advisory.

  - A double-free was found in the way 389-ds-base handles virtual attributes context in persistent searches.
    An attacker could send a series of search requests, forcing the server to behave unexpectedly, and crash.
    (CVE-2021-4091)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Debian 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the dla-3399 advisory.

  - A flaw has been found in 389-ds-base versions 1.4.x.x before 1.4.1.3. When executed in verbose mode, the     dscreate and dsconf commands may display sensitive information, such as the Directory Manager password. An     attacker, able to see the screen or record the terminal standard error output, could use this flaw to gain     sensitive information. (CVE-2019-10224)

  - A flaw was found in the 'deref' plugin of 389-ds-base where it could use the 'search' permission to     display attribute values. In some configurations, this could allow an authenticated attacker to view     private attributes, such as password hashes. (CVE-2019-14824)

  - In 389-ds-base up to version 1.4.1.2, requests are handled by workers threads. Each sockets will be waited     by the worker for at most 'ioblocktimeout' seconds. However this timeout applies only for un-encrypted     requests. Connections using SSL/TLS are not taking this timeout into account during reads, and may hang     longer.An unauthenticated attacker could repeatedly create hanging LDAP requests to hang all the workers,     resulting in a Denial of Service. (CVE-2019-3883)

  - When using a sync_repl client in 389-ds-base, an authenticated attacker can cause a NULL pointer     dereference using a specially crafted query, causing a crash. (CVE-2021-3514)

  - A flaw was found in 389-ds-base. If an asterisk is imported as password hashes, either accidentally or     maliciously, then instead of being inactive, any password will successfully match during authentication.
    This flaw allows an attacker to successfully authenticate as a user whose password was disabled.
    (CVE-2021-3652)

  - A double-free was found in the way 389-ds-base handles virtual attributes context in persistent searches.
    An attacker could send a series of search requests, forcing the server to behave unexpectedly, and crash.
    (CVE-2021-4091)

  - A vulnerability was discovered in the 389 Directory Server that allows an unauthenticated attacker with     network access to the LDAP port to cause a denial of service. The denial of service is triggered by a     single message sent over a TCP connection, no bind or other authentication is required. The message     triggers a segmentation fault that results in slapd crashing. (CVE-2022-0918)

  - A vulnerability was found in the 389 Directory Server that allows expired passwords to access the database     to cause improper authentication. (CVE-2022-0996)

  - A flaw was found In 389-ds-base. When the Content Synchronization plugin is enabled, an authenticated user     can reach a NULL pointer dereference using a specially crafted query. This flaw allows an authenticated     attacker to cause a denial of service. This CVE is assigned against an incomplete fix of CVE-2021-3514.
    (CVE-2022-2850)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of 389-ds-base installed on the remote host is prior to 1.3.10.2-16.69. It is, therefore, affected by a vulnerability as referenced in the ALAS-2022-1629 advisory.

  - A double-free was found in the way 389-ds-base handles virtual attributes context in persistent searches.
    An attacker could send a series of search requests, forcing the server to behave unexpectedly, and crash.
    (CVE-2021-4091)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of 389-ds-base installed on the remote host is prior to 1.3.10.2-16. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2022-1819 advisory.

  - A double-free was found in the way 389-ds-base handles virtual attributes context in persistent searches.
    An attacker could send a series of search requests, forcing the server to behave unexpectedly, and crash.
    (CVE-2021-4091)

  - A vulnerability was discovered in the 389 Directory Server that allows an unauthenticated attacker with     network access to the LDAP port to cause a denial of service. The denial of service is triggered by a     single message sent over a TCP connection, no bind or other authentication is required. The message     triggers a segmentation fault that results in slapd crashing. (CVE-2022-0918)

  - A vulnerability was found in the 389 Directory Server that allows expired passwords to access the database     to cause improper authentication. (CVE-2022-0996)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES15 / SLES_SAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2022:2295-1 advisory.

  - A double-free was found in the way 389-ds-base handles virtual attributes context in persistent searches.
    An attacker could send a series of search requests, forcing the server to behave unexpectedly, and crash.
    (CVE-2021-4091)

  - An access control bypass vulnerability found in 389-ds-base. That mishandling of the filter that would     yield incorrect results, but as that has progressed, can be determined that it actually is an access     control bypass. This may allow any remote unauthenticated user to issue a filter that allows searching for     database items they do not have access to, including but not limited to potentially userPassword hashes     and other sensitive data. (CVE-2022-1949)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES15 / SLES_SAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2022:2163-1 advisory.

  - A flaw was found in 389-ds-base. If an asterisk is imported as password hashes, either accidentally or     maliciously, then instead of being inactive, any password will successfully match during authentication.
    This flaw allows an attacker to successfully authenticate as a user whose password was disabled.
    (CVE-2021-3652)

  - A double-free was found in the way 389-ds-base handles virtual attributes context in persistent searches.
    An attacker could send a series of search requests, forcing the server to behave unexpectedly, and crash.
    (CVE-2021-4091)

  - A vulnerability was discovered in the 389 Directory Server that allows an unauthenticated attacker with     network access to the LDAP port to cause a denial of service. The denial of service is triggered by a     single message sent over a TCP connection, no bind or other authentication is required. The message     triggers a segmentation fault that results in slapd crashing. (CVE-2022-0918)

  - A vulnerability was found in the 389 Directory Server that allows expired passwords to access the database     to cause improper authentication. (CVE-2022-0996)

  - An access control bypass vulnerability found in 389-ds-base. That mishandling of the filter that would     yield incorrect results, but as that has progressed, can be determined that it actually is an access     control bypass. This may allow any remote unauthenticated user to issue a filter that allows searching for     database items they do not have access to, including but not limited to potentially userPassword hashes     and other sensitive data. (CVE-2022-1949)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES15 / SLES_SAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2022:2105-1 advisory.

  - A double-free was found in the way 389-ds-base handles virtual attributes context in persistent searches.
    An attacker could send a series of search requests, forcing the server to behave unexpectedly, and crash.
    (CVE-2021-4091)

  - An access control bypass vulnerability found in 389-ds-base. That mishandling of the filter that would     yield incorrect results, but as that has progressed, can be determined that it actually is an access     control bypass. This may allow any remote unauthenticated user to issue a filter that allows searching for     database items they do not have access to, including but not limited to potentially userPassword hashes     and other sensitive data. (CVE-2022-1949)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES15 / SLES_SAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2022:2109-1 advisory.

  - A flaw was found in 389-ds-base. If an asterisk is imported as password hashes, either accidentally or     maliciously, then instead of being inactive, any password will successfully match during authentication.
    This flaw allows an attacker to successfully authenticate as a user whose password was disabled.
    (CVE-2021-3652)

  - A double-free was found in the way 389-ds-base handles virtual attributes context in persistent searches.
    An attacker could send a series of search requests, forcing the server to behave unexpectedly, and crash.
    (CVE-2021-4091)

  - An access control bypass vulnerability found in 389-ds-base. That mishandling of the filter that would     yield incorrect results, but as that has progressed, can be determined that it actually is an access     control bypass. This may allow any remote unauthenticated user to issue a filter that allows searching for     database items they do not have access to, including but not limited to potentially userPassword hashes     and other sensitive data. (CVE-2022-1949)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES15 / SLES_SAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2022:2081-1 advisory.

  - A double-free was found in the way 389-ds-base handles virtual attributes context in persistent searches.
    An attacker could send a series of search requests, forcing the server to behave unexpectedly, and crash.
    (CVE-2021-4091)

  - An access control bypass vulnerability found in 389-ds-base. That mishandling of the filter that would     yield incorrect results, but as that has progressed, can be determined that it actually is an access     control bypass. This may allow any remote unauthenticated user to issue a filter that allows searching for     database items they do not have access to, including but not limited to potentially userPassword hashes     and other sensitive data. (CVE-2022-1949)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2022:1410 advisory.

    389 Directory Server is an LDAP version 3 (LDAPv3) compliant server. The base packages include the     Lightweight Directory Access Protocol (LDAP) server and command-line utilities for server administration.

    Security Fix(es):

    * 389-ds-base: double free of the virtual attribute context in persistent search (CVE-2021-4091)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

    Bug Fix(es):

    * DB corruption _entryrdn_insert_key - Same DN (dn: nsuniqueid=ffffffff-ffffffff-ffffffff-     ffffffff,<SUFFIX>) is already in the entryrdn file (BZ#2066800)

    * IPA server (389ds) is very slow in execution of some searches (`&(memberOf=...)(objectClass=ipaHost)` in     particular) (BZ#2066801)

    * monitor displays wrong date for connection (BZ#2066848)

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 8 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2022-0889 advisory.

    [1.4.3.23-14]
    - Bump version to 1.4.3.23-14
    - Resolves: Bug 2059893 - Paged search lookthroughlimit counter doesnt take read ahead into account
    - Resolves: Bug 2060106 - Based on 1944494 (RFC 4530 entryUUID attribute) - plugin entryuuid failing
    - Resolves: Bug 2060110 - double-free of the virtual attribute context in persistent search

    [1.4.3.23-13]
    - Bump version to 1.4.3.23-13
    - Resolves: Bug 2056488 - Paged search lookthroughlimit counter doesnt take read ahead into account
    - Resolves: Bug 2047166 - Based on 1944494 (RFC 4530 entryUUID attribute) - plugin entryuuid failing
    - Resolves: Bug 2056481 - double-free of the virtual attribute context in persistent search

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2022:0889 advisory.

    389 Directory Server is an LDAP version 3 (LDAPv3) compliant server. The base packages include the     Lightweight Directory Access Protocol (LDAP) server and command-line utilities for server administration.

    Security Fix(es):

    * 389-ds-base: double free of the virtual attribute context in persistent search (CVE-2021-4091)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

    Bug Fix(es):

    * Paged search lookthroughlimit counter doesnt take read ahead into account (BZ#2059893)

    * Based on 1944494 (RFC 4530 entryUUID attribute) - plugin entryuuid failing (BZ#2060106)

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 7 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2022:0628 advisory.

  - A double-free was found in the way 389-ds-base handles virtual attributes context in persistent searches.
    An attacker could send a series of search requests, forcing the server to behave unexpectedly, and crash.
    (CVE-2021-4091)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Scientific Linux 7 host has packages installed that are affected by a vulnerability as referenced in the SLSA-2022:0628-1 advisory.

  - 389-ds-base: double-free of the virtual attribute context in persistent search (CVE-2021-4091)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 7 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2022-0628 advisory.

    [1.3.10.2-15]
    - Bump version to 1.3.10.2-15
    - Resolves: Bug 2049812 - Fix csn generator to limit time skew drift
    - Resolves: Bug 2048530 - CVE-2021-4091 389-ds-base: double-free of the virtual attribute context in     persistent search

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2022:0628 advisory.

    389 Directory Server is an LDAP version 3 (LDAPv3) compliant server. The base packages include the     Lightweight Directory Access Protocol (LDAP) server and command-line utilities for server administration.

    Security Fix(es):

    * 389-ds-base: double-free of the virtual attribute context in persistent search (CVE-2021-4091)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

    Bug Fix(es):

    * CSN generator can adjust wrongly the local and remote offsets used to generate a CSN (BZ#2049812)

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
194281	RHEL 8 : redhat-ds:11.3 (RHSA-2022:0952)	Nessus	Red Hat Local Security Checks	high
184658	Rocky Linux 8 : 389-ds:1.4 (RLSA-2022:0889)	Nessus	Rocky Linux Local Security Checks	high
174722	Debian DLA-3399-1 : 389-ds-base - LTS security update	Nessus	Debian Local Security Checks	medium
164356	Amazon Linux AMI : 389-ds-base (ALAS-2022-1629)	Nessus	Amazon Linux Local Security Checks	high
163317	Amazon Linux 2 : 389-ds-base (ALAS-2022-1819)	Nessus	Amazon Linux Local Security Checks	medium
162936	SUSE SLES15 Security Update : 389-ds (SUSE-SU-2022:2295-1)	Nessus	SuSE Local Security Checks	high
162523	SUSE SLES15 Security Update : 389-ds (SUSE-SU-2022:2163-1)	Nessus	SuSE Local Security Checks	high
162389	SUSE SLES15 Security Update : 389-ds (SUSE-SU-2022:2105-1)	Nessus	SuSE Local Security Checks	high
162386	SUSE SLES15 Security Update : 389-ds (SUSE-SU-2022:2109-1)	Nessus	SuSE Local Security Checks	high
162238	SUSE SLES15 Security Update : 389-ds (SUSE-SU-2022:2081-1)	Nessus	SuSE Local Security Checks	high
159912	RHEL 8 : 389-ds:1.4 (RHSA-2022:1410)	Nessus	Red Hat Local Security Checks	high
158959	Oracle Linux 8 : 389-ds:1.4 (ELSA-2022-0889)	Nessus	Oracle Linux Local Security Checks	high
158948	RHEL 8 : 389-ds:1.4 (RHSA-2022:0889)	Nessus	Red Hat Local Security Checks	high
158444	CentOS 7 : 389-ds-base (RHSA-2022:0628)	Nessus	CentOS Local Security Checks	high
158329	Scientific Linux Security Update : 389-ds-base on SL7.x x86_64 (2022:0628)	Nessus	Scientific Linux Local Security Checks	high
158267	Oracle Linux 7 : 389-ds-base (ELSA-2022-0628)	Nessus	Oracle Linux Local Security Checks	high
158262	RHEL 7 : 389-ds-base (RHSA-2022:0628)	Nessus	Red Hat Local Security Checks	high

Detections

Analytics

CVE-2021-4091

high

Tenable Plugins

high

high

medium

high

medium

high

high

high

high

high

high

high

high

high

high

high

high