The remote Redhat Enterprise Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2016:2594 advisory.

    389 Directory Server is an LDAP version 3 (LDAPv3) compliant server. The base packages include the     Lightweight Directory Access Protocol (LDAP) server and command-line utilities for server administration.

    The following packages have been upgraded to a newer upstream version: 389-ds-base (1.3.5.10).
    (BZ#1270020)

    Security Fix(es):

    * It was found that 389 Directory Server was vulnerable to a flaw in which the default ACI (Access Control     Instructions) could be read by an anonymous user. This could lead to leakage of sensitive information.
    (CVE-2016-5416)

    * An information disclosure flaw was found in 389 Directory Server. A user with no access to objects in     certain LDAP sub-tree could send LDAP ADD operations with a specific object name. The error message     returned to the user was different based on whether the target object existed or not. (CVE-2016-4992)

    * It was found that 389 Directory Server was vulnerable to a remote password disclosure via timing attack.
    A remote attacker could possibly use this flaw to retrieve directory server password after many tries.
    (CVE-2016-5405)

    The CVE-2016-5416 issue was discovered by Viktor Ashirov (Red Hat); the CVE-2016-4992 issue was discovered     by Petr Spacek (Red Hat) and Martin Basti (Red Hat); and the CVE-2016-5405 issue was discovered by William     Brown (Red Hat).

    Additional Changes:

    For detailed information on changes in this release, see the Red Hat Enterprise Linux 7.3 Release Notes     linked from the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Detections

Analytics

RHEL 7 : 389-ds-base (RHSA-2016:2594)

critical Nessus Plugin ID 94557

Version 2.13