Tbordaz

**Name of the Vulnerable Software and Affected Versions** 389 Directory Server (affected versions not specified) **Description** A vulnerability was discovered in the 389 Directory Server that allows an unauthenticated attacker with network access to the LDAP port to cause a denial of service. The denial of service is triggered by a single message sent over a TCP connection, no bind or other authentication is required. The message triggers a segmentation fault that results in slapd crashing. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** 389 Directory Server versions (affected versions not specified) **Description** The issue is related to a NULL pointer dereference error. An authenticated attacker can cause a crash by using a specially crafted query with a sync repl client in 389-ds-base. This allows a remote attacker to cause a denial of service. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** 389-ds-base versions 1.4.1.2 and earlier **Description** The issue allows an unauthenticated attacker to create hanging LDAP requests, potentially hanging all worker threads and resulting in a Denial of Service. This occurs because connections using SSL/TLS do not take into account the 'ioblocktimeout' during reads, unlike un-encrypted requests. **Recommendations** For 389-ds-base versions 1.4.1.2 and earlier, consider disabling SSL/TLS connections or restricting the use of LDAP requests until a patch is available. As a temporary workaround, adjust the 'ioblocktimeout' value to minimize the risk of exploitation.