Red Hat 389 Directory Server any version

An access control bypass vulnerability found in 389-ds-base. That mishandling of the filter that would yield incorrect results, but as that has progressed, can be determined that it actually is an access control bypass. This may allow any remote unauthenticated user to issue a filter that allows searching for database items they do not have access to, including but not limited to potentially userPassword hashes and other sensitive data.

The _ger_parse_control function in Red Hat Directory Server 8 and the 389 Directory Server allows attackers to cause a denial of service (NULL pointer dereference) via a crafted search query.

389-ds-base: 389-ds-base: unbounded ldap controls count in get_ldapmessage_controls_ext() causes cpu and heap amplification (remote dos)

389-ds-base: 389-ds-base: pre-authentication stack buffer overflow in get_ruvelement_from_berval() via unbounded replica id parsing

389-ds-base: 389-ds-base: null pointer dereference in deref control plugin ber parser

389-ds-base: 389-ds-base: pre-auth ldap filter injection in cleanallruv status check

A flaw was found in the 389 Directory Server that allows users to cause a crash in the LDAP server using ldapsearch with server side sort.

When using a sync_repl client in 389-ds-base, an authenticated attacker can cause a NULL pointer dereference using a specially crafted query, causing a crash.

389-ds-base: unauthenticated user can trigger a dos by sending a specific extended search request

389-ds-base: 389-ds-base: smd5 password storage plugin salt length integer underflow crash

389-ds-base: 389-ds-base: content sync plugin unbounded queue growth and race conditions

389-ds-base: 389-ds-base: heap out-of-bounds read in ldif parser str2entry_state_information_from_type()

389-ds-base: 389-ds-base: heap buffer over-read in ldap_utf8prev() via str2simple filter parsing

389-ds-base: a heap overflow leading to denail-of-servce while writing a value larger than 256 chars (in log_entry_attr)

389-ds-base: 389-ds-base: sasl plain bind installs connection credentials before account-lock check, allowing continued access as a locked account

389-ds-base: 389-ds-base: heap-buffer-overflows in __aclp__normalize_acltxt()

When binding against a DN during authentication, the reply from 389-ds-base will be different whether the DN exists or not. This can be used by an unauthenticated attacker to check the existence of an entry in the LDAP database.

389-ds-base: 389-ds-base: heap-buffer-overflow in dn normalization via quoted multivalued rdn

389-ds-base: 389-ds-base: use-after-free in schema reload via attr_syntax_swap_ht()

389-ds-base: 389-ds-base: stack buffer overflow in checkprefix() algorithm id parsing

389-ds-base: 389-ds-base: static initialization vector in aes-cbc/3des-cbc attribute encryption

389-ds-base: 389-ds-base: partial stack address information leak via ber_printf type confusion in sso token handler

389-ds-base: 389-ds-base: non-constant-time comparison in pbkdf2-sha256 password verification