PT-2012-5407 · Red Hat+1 · 389 Directory Server+2

Noriko Hosoi · Published 2012-10-01 · Updated 2013-03-09 · CVE-2012-4450

Positive Technologies (AI Summary)

CVSS v2.0

6.0

Medium

Base vector

AV:N/AC:M/Au:S/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions 389 Directory Server version 1.2.10

Description The issue arises from the improper update of the Access Control List (ACL) when a Distinguished Name (DN) entry is moved by a modrdn operation. This allows remote authenticated users with specific permissions to bypass ACL restrictions and access the DN entry.

Recommendations For 389 Directory Server version 1.2.10, consider restricting access to the modrdn operation until a proper fix is applied to ensure the ACL is correctly updated when a DN entry is moved.

Fix

Weakness Enumeration

CWE-264

Related Identifiers

CESA-2013_0503

CVE-2012-4450

RHSA-2013:0503

RHSA-2013_0503

Affected Products

389 Directory Server

Centos

Red Hat

References · 25

• https://security-tracker.debian.org/tracker/CVE-2012-4450 · Vendor Advisory
• http://secunia.com/advisories/50713 · Vendor Advisory
• https://linux.oracle.com/errata/ELSA-2013-0503.html · Vendor Advisory
• http://git.fedorahosted.org/cgit/389/ds.git/commit/?id=5beb93d42efb807838c09c5fab898876876f8d09 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2012-4450 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-4450 · Security Note
• https://osv.dev/vulnerability/DEBIAN-CVE-2012-4450 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2012-4450 · Vendor Advisory
• http://rhn.redhat.com/errata/RHSA-2013-0503.html · Vendor Advisory
• https://lists.centos.org/pipermail/centos-cr-announce/2013-February/013358.html · Note
• http://securityfocus.com/bid/55690 · Note
• https://bugzilla.redhat.com/show_bug.cgi?id=860772 · Note
• https://lists.centos.org/pipermail/centos-announce/2013-March/056197.html · Note
• https://lists.centos.org/pipermail/centos-cr-announce/2013-February/020048.html · Note
• http://openwall.com/lists/oss-security/2012/09/26/5 · Note