Bug 492208 – <net-nds/389-ds-base-1.3.4.8: DoS due to improper handling of ger attr searches (CVE-2013-4485)

• Status: RESOLVED FIXED
• Product: Gentoo Security

[Description Agostino Sarubbo 2013-11-21 17:16:35 UTC]

From ${URL} :

A flaw in how 389-ds-base and Red Hat Directory Server handled the checking of access rights on entries 
using GER (Get Effective Rights), a way to extend directory searches to also display what access rights a 
user has to a specified entry.  When an attribute list is given in the search request, and if there are 
several attributes whose names contain the '@' character, 389-ds-base and Red Hat Directory Server would 
crash.  An attacker able to contact the server would be able to submit this type of search request with no 
authentication required.


@maintainer(s): since the package has never been marked as stable, we don't need to stabilize it. Please remove the affected versions from the tree.

[Comment 1 Agostino Sarubbo 2013-11-25 19:45:19 UTC]

fixed in 1.3.1.15

[Comment 2 GLSAMaker/CVETool Bot 2013-12-09 05:56:03 UTC]

CVE-2013-4485 (http://nvd.nist.gov/nvd.cfm?cvename=CVE-2013-4485):
  389 Directory Server 1.2.11.15 (aka Red Hat Directory Server before
  8.2.11-14) allows remote authenticated users to cause a denial of service
  (crash) via multiple @ characters in a GER attribute list in a search
  request.

[Comment 3 William Brown 2016-02-07 01:48:28 UTC]

Hi,

We have updated 389-ds-base to 1.3.4.7. This should resolve the issue.

Thanks,

[Comment 4 Adam Feldman 2016-02-07 01:56:29 UTC]

Referenced commit 5a7174bf7122309eee568651fb5f3413155f9fc2

[Comment 5 Aaron Bauman (RETIRED) 2016-03-29 11:29:10 UTC]

No vulnerable versions in tree.