PT-2011-2017 · Red Hat · 389 Directory Server

Vincent Danen · Published 2011-02-23 · Updated 2011-03-31 · CVE-2011-0019

Positive Technologies (AI Summary)

CVSS v2.0

7.5

High

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions 389 Directory Server version 1.2.7.5

Description The issue is related to the handling of simple paged result searches by the slapd component in 389 Directory Server. This can be exploited by remote attackers to cause a denial of service, resulting in a daemon crash, or potentially have other unspecified impacts. This can be achieved through the submission of multiple search requests.

Recommendations For version 1.2.7.5, consider restricting access to the simple paged result search functionality until a patch is available. As a temporary workaround, limiting the number of concurrent search requests may help minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

RCE

Weakness Enumeration

CWE-20

Related Identifiers

CVE-2011-0019

RHSA-2011:0293

Affected Products

389 Directory Server

References · 6

• https://nvd.nist.gov/vuln/detail/CVE-2011-0019 · Security Note
• http://redhat.com/support/errata/RHSA-2011-0293.html · Vendor Advisory
• http://securitytracker.com/id?1025102 · Note
• https://bugzilla.redhat.com/show_bug.cgi?id=666076 · Note
• https://bugzilla.redhat.com/show_bug.cgi?id=670914 · Note
• http://securityfocus.com/bid/46489 · Note