[<prev] [next>] [day] [month] [year] [list]
Message-ID: <20131121151507.GP2523@redhat.com>
Date: Thu, 21 Nov 2013 08:15:07 -0700
From: Vincent Danen <vdanen@...hat.com>
To: oss-security@...ts.openwall.com
Subject: 389-ds DoS due to improper handling of ger attr searches
(CVE-2013-4485)
A flaw in how 389-ds-base and Red Hat Directory Server handled the
checking of access rights on entries using GER (Get Effective Rights), a
way to extend directory searches to also display what access rights a
user has to a specified entry. When an attribute list is given in the
search request, and if there are several attributes whose names contain
the '@' character, 389-ds-base and Red Hat Directory Server would crash.
An attacker able to contact the server would be able to submit this type
of search request with no authentication required.
https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2013-4485
(Obviously no CVE is required, posting here as this was previously sent
to the distros@ mailing list)
--
Vincent Danen / Red Hat Security Response Team
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
