PT-2018-7121 · Red Hat+1 · 389-Ds-Base+1

Firstyear · Published 2016-11-09 · Updated 2019-10-09 · CVE-2017-2591

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Medium

Base vector

AV:N/AC:L/Au:N/C:N/I:N/A:P

Name of the Vulnerable Software and Affected Versions: 389-ds-base versions prior to 1.3.6

Description: The issue arises from an improperly NULL terminated array in the uniqueness entry to config() function within the "attribute uniqueness" plugin of 389 Directory Server. This could allow an authenticated, or possibly unauthenticated, attacker to force an out-of-bound heap memory read, potentially causing a crash of the LDAP service.

Recommendations: For versions prior to 1.3.6, update to version 1.3.6 or later to resolve the issue.

Fix

Heap Based Buffer Overflow

Out of bounds Read

Weakness Enumeration

CWE-122

CWE-125

Related Identifiers

ALT-PU-2016-2270

CVE-2017-2591

MGASA-2017-0028

Affected Products

389-Ds-Base

Alt Linux

References · 15

• https://osv.dev/vulnerability/CVE-2017-2591 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2017-2591 · Vendor Advisory
• https://advisories.mageia.org/MGASA-2017-0028.html · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2017-2591 · Security Note
• https://cve.org/CVERecord?id=CVE-2017-2591 · Security Note
• https://osv.dev/vulnerability/UBUNTU-CVE-2017-2591 · Vendor Advisory
• https://ubuntu.com/security/CVE-2017-2591 · Vendor Advisory
• https://osv.dev/vulnerability/MGASA-2017-0028 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2017-2591 · Vendor Advisory
• https://pagure.io/389-ds-base/issue/48986 · Patch
• http://openwall.com/lists/oss-security/2017/01/18/5 · Note
• http://securityfocus.com/bid/95670 · Note
• https://bugs.mageia.org/show_bug.cgi?id=20138 · Note
• https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2017-2591 · Note
• https://fedorahosted.org/389/ticket/48986 · Note