CVE-2012-0833: Low severity red hat 389 directory server vulnerability

Q: What is the severity of CVE-2012-0833?

CVE-2012-0833 is classified as a denial of service vulnerability in the 389 Directory Server.

Q: How do I fix CVE-2012-0833?

To fix CVE-2012-0833, you should upgrade 389 Directory Server to version 1.2.10 or later.

Q: Which versions of 389 Directory Server are affected by CVE-2012-0833?

CVE-2012-0833 affects 389 Directory Server versions prior to 1.2.10.

Q: Can CVE-2012-0833 be exploited remotely?

Yes, CVE-2012-0833 can be exploited remotely by authenticated LDAP users leveraging certificate groups.

Q: What impact does CVE-2012-0833 have on the system?

CVE-2012-0833 can lead to a denial of service, causing disruptions in the 389 Directory Server operations.

Published Jul 3, 2012

Updated

The acllashandlegroupentry function in servers/plugins/acl/acllas.c in 389 Directory Server before 1.2.10 does not properly handled access control instructions (ACIs) that use certificate groups, which allows remote authenticated LDAP users with a certificate group to cause a denial of service (infinite loop and CPU consumption) by binding to the server.

Affected Software

31 affected components

Fedoraproject 389 Directory Server<=1.2.10

Fedoraproject 389 Directory Server=1.2.1

Fedoraproject 389 Directory Server=1.2.2

Fedoraproject 389 Directory Server=1.2.3

Fedoraproject 389 Directory Server=1.2.5

Fedoraproject 389 Directory Server=1.2.5-rc1

Fedoraproject 389 Directory Server=1.2.5-rc2

Fedoraproject 389 Directory Server=1.2.5-rc3

Fedoraproject 389 Directory Server=1.2.5-rc4

Fedoraproject 389 Directory Server=1.2.6

Fedoraproject 389 Directory Server=1.2.6-a2

Fedoraproject 389 Directory Server=1.2.6-a3

Fedoraproject 389 Directory Server=1.2.6-a4

Fedoraproject 389 Directory Server=1.2.6-rc1

Fedoraproject 389 Directory Server=1.2.6-rc2

Fedoraproject 389 Directory Server=1.2.6-rc3

Fedoraproject 389 Directory Server=1.2.6-rc6

Fedoraproject 389 Directory Server=1.2.6-rc7

Fedoraproject 389 Directory Server=1.2.6.1

Fedoraproject 389 Directory Server=1.2.7-alpha3

Fedoraproject 389 Directory Server=1.2.7.5

Fedoraproject 389 Directory Server=1.2.8-alpha1

Fedoraproject 389 Directory Server=1.2.8-alpha2

Fedoraproject 389 Directory Server=1.2.8-alpha3

Fedoraproject 389 Directory Server=1.2.8-rc1

Fedoraproject 389 Directory Server=1.2.8-rc2

Fedoraproject 389 Directory Server=1.2.8.1

Fedoraproject 389 Directory Server=1.2.8.2

Fedoraproject 389 Directory Server=1.2.8.3

Fedoraproject 389 Directory Server=1.2.9.9

Fedoraproject 389 Directory Server=1.2.10-alpha8

Remediation

Patch Available

https://fedorahosted.org/389/changeset/1bbbb3e5049c1aa0650546efab87ed2f1ea59637/389-ds-base

Event History

Jul 3, 2012

CVE Published

via MITRE·04:00 PM

Data Sourced

via MITRE·04:00 PM

Description

Frequently Asked Questions

What is the severity of CVE-2012-0833?

CVE-2012-0833 is classified as a denial of service vulnerability in the 389 Directory Server.

How do I fix CVE-2012-0833?

To fix CVE-2012-0833, you should upgrade 389 Directory Server to version 1.2.10 or later.

Which versions of 389 Directory Server are affected by CVE-2012-0833?