CVE-2013-1897: Low severity red hat 389 directory server vulnerability

Published Mar 26, 2013

Updated

It was found that the 389 Directory Server did not properly restrict access to entries when the 'nsslapd-allow-anonymous-access' configuration setting is set to 'rootdse'. An anonymous user could connect to the LDAP database and, if the search scope is set to BASE, obtain access to information outside of the rootDSE. The 'rootdse' option exists to provide anonymous access to the rootDSE but no other entries in the directory. An administrator could believe that directory entries are being restricted with this option enabled, however the information provided would be the same as if 'nsslapd-allow-anonymous-access' were set to 'on'.

ACI's are still properly evaluated despite this flaw, so this can easily be mitigated by removing the anonymous read ACL.

Other sources

The dosearch function in ldap/servers/slapd/search.c in 389 Directory Server 1.2.x before 1.2.11.20 and 1.3.x before 1.3.0.5 does not properly restrict access to entries when the nsslapd-allow-anonymous-access configuration is set to rootdse and the BASE search scope is used, which allows remote attackers to obtain sensitive information outside of the rootDSE via a crafted LDAP search.

— MITRE

Affected Software

52 affected components

Fedoraproject 389 Directory Server=1.2.1

Fedoraproject 389 Directory Server=1.2.2

Fedoraproject 389 Directory Server=1.2.3

Fedoraproject 389 Directory Server=1.2.5

Fedoraproject 389 Directory Server=1.2.5-rc1

Fedoraproject 389 Directory Server=1.2.5-rc2

Fedoraproject 389 Directory Server=1.2.5-rc3

Fedoraproject 389 Directory Server=1.2.5-rc4

Fedoraproject 389 Directory Server=1.2.6

Fedoraproject 389 Directory Server=1.2.6-a2

Fedoraproject 389 Directory Server=1.2.6-a3

Fedoraproject 389 Directory Server=1.2.6-a4

Fedoraproject 389 Directory Server=1.2.6-rc1

Fedoraproject 389 Directory Server=1.2.6-rc2

Fedoraproject 389 Directory Server=1.2.6-rc3

Fedoraproject 389 Directory Server=1.2.6-rc6

Fedoraproject 389 Directory Server=1.2.6-rc7

Fedoraproject 389 Directory Server=1.2.6.1

Fedoraproject 389 Directory Server=1.2.7-alpha3

Fedoraproject 389 Directory Server=1.2.7.5

Fedoraproject 389 Directory Server=1.2.8-alpha1

Fedoraproject 389 Directory Server=1.2.8-alpha2

Fedoraproject 389 Directory Server=1.2.8-alpha3

Fedoraproject 389 Directory Server=1.2.8-rc1

Fedoraproject 389 Directory Server=1.2.8-rc2

Fedoraproject 389 Directory Server=1.2.8.1

Fedoraproject 389 Directory Server=1.2.8.2

Fedoraproject 389 Directory Server=1.2.8.3

Fedoraproject 389 Directory Server=1.2.9.9

Fedoraproject 389 Directory Server=1.2.10

Fedoraproject 389 Directory Server=1.2.10-alpha8

Fedoraproject 389 Directory Server=1.2.10-rc1

Fedoraproject 389 Directory Server=1.2.10.2

Fedoraproject 389 Directory Server=1.2.10.3

Fedoraproject 389 Directory Server=1.2.10.4

Fedoraproject 389 Directory Server=1.2.10.11

Fedoraproject 389 Directory Server=1.2.11.1

Fedoraproject 389 Directory Server=1.2.11.5

Fedoraproject 389 Directory Server=1.2.11.6

Fedoraproject 389 Directory Server=1.2.11.8

Fedoraproject 389 Directory Server=1.2.11.9

Fedoraproject 389 Directory Server=1.2.11.10

Fedoraproject 389 Directory Server=1.2.11.11

Fedoraproject 389 Directory Server=1.2.11.12

Fedoraproject 389 Directory Server=1.2.11.13

Fedoraproject 389 Directory Server=1.2.11.14

Fedoraproject 389 Directory Server=1.2.11.15

Fedoraproject 389 Directory Server=1.2.11.17

Fedoraproject 389 Directory Server=1.2.11.19

Fedoraproject 389 Directory Server=1.3.0.2

Fedoraproject 389 Directory Server=1.3.0.3

Fedoraproject 389 Directory Server=1.3.0.4

Event History

Mar 26, 2013

Data Sourced

10:23 PM

DescriptionSeverityAffected Software

May 13, 2013

CVE Published

via MITRE·11:00 PM

Data Sourced

via MITRE·11:00 PM

Description

Frequently Asked Questions

What is the severity of CVE-2013-1897?

The severity of CVE-2013-1897 is classified as moderate due to unauthorized access risks.

How do I fix CVE-2013-1897?

To fix CVE-2013-1897, you should disable anonymous access or apply the latest security patches for the affected versions of the 389 Directory Server.

What impact does CVE-2013-1897 have on users?

CVE-2013-1897 allows anonymous users to gain unauthorized access to sensitive directory information.

Which versions of the 389 Directory Server are affected by CVE-2013-1897?

CVE-2013-1897 affects versions 1.2.1 through 1.3.0.4 of the 389 Directory Server.

Is authentication required to exploit CVE-2013-1897?

No authentication is required to exploit CVE-2013-1897, making it particularly concerning for data exposure.