ArchLinux: 202107-72: 389-ds-base: multiple issues

Advisories

Arch Linux Security Advisory ASA-202107-72
==========================================

Severity: Medium
Date    : 2021-07-27
CVE-ID  : CVE-2021-3514 CVE-2021-3652
Package : 389-ds-base
Type    : multiple issues
Remote  : Yes
Link    : https://security.archlinux.org/AVG-2206

Summary
=======

The package 389-ds-base before version 2.0.7-1 is vulnerable to
multiple issues including authentication bypass and denial of service.

Resolution
==========

Upgrade to 2.0.7-1.

# pacman -Syu "389-ds-base>=2.0.7-1"

The problems have been fixed upstream in version 2.0.7.

Workaround
==========

None.

Description
===========

- CVE-2021-3514 (denial of service)

A security issue was found in 389-ds-base before version 2.0.5. When
using a sync_repl client, an authenticated attacker can cause a NULL
pointer dereference using a specially crafted query, causing a crash of
389-ds-base.

- CVE-2021-3652 (authentication bypass)

In 389-ds-base before version 2.0.7, it was found that if an asterisk
is imported as a password hash, either accidentally or maliciously,
then instead of being inactive, any password will successfully match
during authentication. This would allow an attacker to successfully
authenticate as a user who's password was supposedly disabled.

Impact
======

An attacker could successfully authenticate as a user who's password
was supposedly disabled. Furthermore, an authenticated attacker could
crash the 389-ds-base server.

References
==========

https://bugzilla.redhat.com/show_bug.cgi?id=1952907
https://github.com/389ds/389-ds-base/issues/4711
https://github.com/389ds/389-ds-base/pull/4738
https://github.com/389ds/389-ds-base/commit/d7eef2fcfbab2ef8aa6ee0bf60f0a9b16ede66e0
https://bugzilla.redhat.com/show_bug.cgi?id=1982782
https://github.com/389ds/389-ds-base/issues/4817
https://github.com/389ds/389-ds-base/pull/4819
https://github.com/389ds/389-ds-base/commit/aeb90eb0c41fc48541d983f323c627b2e6c328c7
https://security.archlinux.org/CVE-2021-3514
https://security.archlinux.org/CVE-2021-3652

ArchLinux: 202107-72: 389-ds-base: multiple issues

July 30, 2021
The package 389-ds-base before version 2.0.7-1 is vulnerable to multiple issues including authentication bypass and denial of service

Summary

- CVE-2021-3514 (denial of service)
A security issue was found in 389-ds-base before version 2.0.5. When using a sync_repl client, an authenticated attacker can cause a NULL pointer dereference using a specially crafted query, causing a crash of 389-ds-base.
- CVE-2021-3652 (authentication bypass)
In 389-ds-base before version 2.0.7, it was found that if an asterisk is imported as a password hash, either accidentally or maliciously, then instead of being inactive, any password will successfully match during authentication. This would allow an attacker to successfully authenticate as a user who's password was supposedly disabled.

Resolution

Upgrade to 2.0.7-1.
# pacman -Syu "389-ds-base>=2.0.7-1"
The problems have been fixed upstream in version 2.0.7.

References

https://bugzilla.redhat.com/show_bug.cgi?id=1952907 https://github.com/389ds/389-ds-base/issues/4711 https://github.com/389ds/389-ds-base/pull/4738 https://github.com/389ds/389-ds-base/commit/d7eef2fcfbab2ef8aa6ee0bf60f0a9b16ede66e0 https://bugzilla.redhat.com/show_bug.cgi?id=1982782 https://github.com/389ds/389-ds-base/issues/4817 https://github.com/389ds/389-ds-base/pull/4819 https://github.com/389ds/389-ds-base/commit/aeb90eb0c41fc48541d983f323c627b2e6c328c7 https://security.archlinux.org/CVE-2021-3514 https://security.archlinux.org/CVE-2021-3652

Severity
CVE-ID : CVE-2021-3514 CVE-2021-3652
Package : 389-ds-base
Type : multiple issues
Remote : Yes
Link : https://security.archlinux.org/AVG-2206

Impact

An attacker could successfully authenticate as a user who's password was supposedly disabled. Furthermore, an authenticated attacker could crash the 389-ds-base server.

Workaround

None.

Related News

We use cookies to provide and improve our services. By using our site, you consent to our Cookie Policy.