oss-security - CVE Request -- 389-ds-base: Change on SLAPI_MODRDN_NEWSUPERIOR is not evaluated in ACL (ACL rules bypass possible)

Follow @Openwall on Twitter for new release announcements and other news

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Message-ID: <1854551163.1629578.1348653253763.JavaMail.root@redhat.com>
Date: Wed, 26 Sep 2012 05:54:13 -0400 (EDT)
From: Jan Lieskovsky <jlieskov@...hat.com>
To: "Steven M. Christey" <coley@...us.mitre.org>
Cc: oss-security@...ts.openwall.com, Noriko Hosoi <nhosoi@...hat.com>,
        Rich Megginson <rmeggins@...hat.com>
Subject: CVE Request -- 389-ds-base: Change on SLAPI_MODRDN_NEWSUPERIOR is
 not evaluated in ACL (ACL rules bypass possible)

Hello Kurt, Steve, vendors,

  Noriko Hosoi of Red Hat notified us about the following deficiency:

A possibility to bypass access control list (ACL) definitions was found
in the way 389 Directory Server performed LDAP modifyRDN operation upon
request from client. When a user has been granted access to set of DN
entries, but denied access to a specific subset of those entries, it
was possible the user to obtain temporary (till next Directory Server
restart) access to that subset of entries (they should not have had
otherwise ability to access) when the DN entry was moved via database
modify RDN function.

Upstream ticket:
[1] https://fedorahosted.org/389/ticket/340

Relevant upstream patch:
[2] http://git.fedorahosted.org/cgit/389/ds.git/commit/?id=5beb93d42efb807838c09c5fab898876876f8d09

Could you allocate a CVE id for this?

Thank you && Regards, Jan.
--
Jan iankko Lieskovsky / Red Hat Security Response Team

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.