PT-2011-2020 · Red Hat · 389 Directory Server

Published 2011-02-23 · Updated 2011-03-31 · CVE-2011-0022

Positive Technologies (AI Summary)

CVSS v2.0

4.7

Medium

Base vector

AV:L/AC:M/Au:N/C:N/I:N/A:C

Name of the Vulnerable Software and Affected Versions 389 Directory Server versions 1.2.x

Description The issue allows local users to cause a denial of service, potentially leading to daemon outage or arbitrary process termination, by replacing PID files in the /var/run/dirsrv directory. This is due to the setup scripts using 0777 permissions for the /var/run/dirsrv directory when multiple unprivileged instances are configured.

Recommendations For 389 Directory Server versions 1.2.x, consider changing the permissions of the /var/run/dirsrv directory to prevent local users from replacing PID files and causing a denial of service. As a temporary workaround, restrict access to the /var/run/dirsrv directory to minimize the risk of exploitation.

Fix

Weakness Enumeration

CWE-399

Related Identifiers

CVE-2011-0022

RHSA-2011:0293

Affected Products

389 Directory Server

References · 5

• https://nvd.nist.gov/vuln/detail/CVE-2011-0022 · Security Note
• http://redhat.com/support/errata/RHSA-2011-0293.html · Vendor Advisory
• http://securitytracker.com/id?1025102 · Note
• https://bugzilla.redhat.com/show_bug.cgi?id=671199 · Note
• http://securityfocus.com/bid/46489 · Note