Gentoo Websites Logo
Go to: Gentoo Home Documentation Forums Lists Bugs Planet Store Wiki Get Gentoo!
Bug 492208 (CVE-2013-4485) - <net-nds/389-ds-base-1.3.4.8: DoS due to improper handling of ger attr searches (CVE-2013-4485)
Summary: <net-nds/389-ds-base-1.3.4.8: DoS due to improper handling of ger attr search...
Status: RESOLVED FIXED
Alias: CVE-2013-4485
Product: Gentoo Security
Classification: Unclassified
Component: Vulnerabilities (show other bugs)
Hardware: All Linux
: Normal trivial (vote)
Assignee: Gentoo Security
URL: https://bugzilla.redhat.com/show_bug....
Whiteboard: ~3 [noglsa]
Keywords:
Depends on:
Blocks:
 
Reported: 2013-11-21 17:16 UTC by Agostino Sarubbo
Modified: 2016-03-29 11:29 UTC (History)
1 user (show)

See Also:
Package list:
Runtime testing required: ---


Attachments

Note You need to log in before you can comment on or make changes to this bug.
Description Agostino Sarubbo gentoo-dev 2013-11-21 17:16:35 UTC
From ${URL} :

A flaw in how 389-ds-base and Red Hat Directory Server handled the checking of access rights on entries 
using GER (Get Effective Rights), a way to extend directory searches to also display what access rights a 
user has to a specified entry.  When an attribute list is given in the search request, and if there are 
several attributes whose names contain the '@' character, 389-ds-base and Red Hat Directory Server would 
crash.  An attacker able to contact the server would be able to submit this type of search request with no 
authentication required.


@maintainer(s): since the package has never been marked as stable, we don't need to stabilize it. Please remove the affected versions from the tree.
Comment 1 Agostino Sarubbo gentoo-dev 2013-11-25 19:45:19 UTC
fixed in 1.3.1.15
Comment 2 GLSAMaker/CVETool Bot gentoo-dev 2013-12-09 05:56:03 UTC
CVE-2013-4485 (http://nvd.nist.gov/nvd.cfm?cvename=CVE-2013-4485):
  389 Directory Server 1.2.11.15 (aka Red Hat Directory Server before
  8.2.11-14) allows remote authenticated users to cause a denial of service
  (crash) via multiple @ characters in a GER attribute list in a search
  request.
Comment 3 William Brown 2016-02-07 01:48:28 UTC
Hi,

We have updated 389-ds-base to 1.3.4.7. This should resolve the issue.

Thanks,
Comment 4 Adam Feldman gentoo-dev 2016-02-07 01:56:29 UTC
Referenced commit 5a7174bf7122309eee568651fb5f3413155f9fc2
Comment 5 Aaron Bauman Gentoo Infrastructure gentoo-dev Security 2016-03-29 11:29:10 UTC
No vulnerable versions in tree.