CVE-2008-2930: High severity red hat 389 directory server vulnerability
It was discovered that Red Hat Directory Server and Fedora Directory Server is prone to a temporary denial of service attack (high CPU usage) via crafted LDAP search patterns. LDAP search patterns are internally translated to regular expressions. If the regular expression is matched against specially crafted record already stored in the LDAP, it may cause regular expression NFA to iterate over large amount of states, causing one slapd thread to occupy CPU for excessive amount of time.
Additionally, due to a current design of the regular expression handling code, only one slapd thread can execute regular expression NFA code at the time. Because of that, during the processing of such CPU intensive search request, all other search requests using patterns are blocked.
Affected version: Red Hat Directory Server 7.1 and 8 Fedora Directory Server 1.1.1
Other sources
Red Hat Directory Server 7.1 before SP7, Red Hat Directory Server 8, and Fedora Directory Server 1.1.1 allow remote attackers to cause a denial of service (CPU consumption and search outage) via crafted LDAP search requests with patterns, related to a single-threaded regular-expression subsystem.
— MITRE
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2008-2930?
CVE-2008-2930 has a high severity rating due to its potential for causing a temporary denial of service through high CPU usage.
How do I fix CVE-2008-2930?
To fix CVE-2008-2930, you should update your Red Hat Directory Server or Fedora Directory Server to the latest patched version as recommended by Red Hat.
What versions are affected by CVE-2008-2930?
CVE-2008-2930 affects Red Hat Directory Server versions 7.1 (SP1 to SP6) and 8.0, as well as Fedora Directory Server version 1.1.1.
What type of attack does CVE-2008-2930 involve?
CVE-2008-2930 involves a denial of service attack that exploits crafted LDAP search patterns leading to excessive CPU usage.
What are the implications of CVE-2008-2930 for my server's security?
The implications of CVE-2008-2930 include potential downtime and degraded performance of services utilizing the affected directory servers.