PT-2012-5407 · Red Hat+1 · 389 Directory Server+2

Noriko Hosoi · Publicado 2012-10-01 · Atualizado 2013-03-09 · CVE-2012-4450

Positive Technologies (AI Summary)

CVSS v2.0

6.0

Média

Vetor base

AV:N/AC:M/Au:S/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions 389 Directory Server version 1.2.10

Description The issue arises from the improper update of the Access Control List (ACL) when a Distinguished Name (DN) entry is moved by a modrdn operation. This allows remote authenticated users with specific permissions to bypass ACL restrictions and access the DN entry.

Recommendations For 389 Directory Server version 1.2.10, consider restricting access to the modrdn operation until a proper fix is applied to ensure the ACL is correctly updated when a DN entry is moved.

Correção

Enumeração de Fraquezas

CWE-264

Identificadores relacionados

CESA-2013_0503

CVE-2012-4450

RHSA-2013:0503

RHSA-2013_0503

Produtos afetados

389 Directory Server

Centos

Red Hat

Referências · 25

• https://lists.centos.org/pipermail/centos-cr-announce/2013-February/013358.html · Nota
• http://securityfocus.com/bid/55690 · Nota
• https://bugzilla.redhat.com/show_bug.cgi?id=860772 · Nota
• https://security-tracker.debian.org/tracker/CVE-2012-4450 · Aviso do Fabricante
• https://lists.centos.org/pipermail/centos-announce/2013-March/056197.html · Nota
• https://lists.centos.org/pipermail/centos-cr-announce/2013-February/020048.html · Nota
• http://openwall.com/lists/oss-security/2012/09/26/5 · Nota
• https://lists.centos.org/pipermail/centos-cr-announce/2013-February/026738.html · Nota
• http://secunia.com/advisories/50713 · Aviso do Fabricante
• https://linux.oracle.com/errata/ELSA-2013-0503.html · Aviso do Fabricante
• http://openwall.com/lists/oss-security/2012/09/26/3 · Nota
• http://git.fedorahosted.org/cgit/389/ds.git/commit/?id=5beb93d42efb807838c09c5fab898876876f8d09 · Aviso do Fabricante
• https://lists.centos.org/pipermail/centos-announce/2013-March/081440.html · Nota
• https://lists.centos.org/pipermail/centos-cr-announce/2013-February/006668.html · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2012-4450 · Nota de Segurança