PT-2018-7121 · Red Hat+1 · 389-Ds-Base+1

Firstyear · Publicado 2016-11-09 · Atualizado 2019-10-09 · CVE-2017-2591

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Média

Vetor base

AV:N/AC:L/Au:N/C:N/I:N/A:P

Name of the Vulnerable Software and Affected Versions: 389-ds-base versions prior to 1.3.6

Description: The issue arises from an improperly NULL terminated array in the uniqueness entry to config() function within the "attribute uniqueness" plugin of 389 Directory Server. This could allow an authenticated, or possibly unauthenticated, attacker to force an out-of-bound heap memory read, potentially causing a crash of the LDAP service.

Recommendations: For versions prior to 1.3.6, update to version 1.3.6 or later to resolve the issue.

Correção

Heap Based Buffer Overflow

Out of bounds Read

Enumeração de Fraquezas

CWE-122

CWE-125

Identificadores relacionados

ALT-PU-2016-2270

CVE-2017-2591

MGASA-2017-0028

Produtos afetados

389-Ds-Base

Alt Linux

Referências · 15

• http://openwall.com/lists/oss-security/2017/01/18/5 · Nota
• http://securityfocus.com/bid/95670 · Nota
• https://osv.dev/vulnerability/CVE-2017-2591 · Aviso do Fabricante
• https://security-tracker.debian.org/tracker/CVE-2017-2591 · Aviso do Fabricante
• https://advisories.mageia.org/MGASA-2017-0028.html · Nota de Segurança
• https://nvd.nist.gov/vuln/detail/CVE-2017-2591 · Nota de Segurança
• https://cve.org/CVERecord?id=CVE-2017-2591 · Nota de Segurança
• https://osv.dev/vulnerability/UBUNTU-CVE-2017-2591 · Aviso do Fabricante
• https://ubuntu.com/security/CVE-2017-2591 · Aviso do Fabricante
• https://bugs.mageia.org/show_bug.cgi?id=20138 · Nota
• https://osv.dev/vulnerability/MGASA-2017-0028 · Aviso do Fabricante
• https://osv.dev/vulnerability/DEBIAN-CVE-2017-2591 · Aviso do Fabricante
• https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2017-2591 · Nota
• https://pagure.io/389-ds-base/issue/48986 · Correção
• https://fedorahosted.org/389/ticket/48986 · Nota