CVE-2013-1897
First published: Tue Mar 26 2013(Updated: )
It was found that the 389 Directory Server did not properly restrict access to entries when the 'nsslapd-allow-anonymous-access' configuration setting is set to 'rootdse'. An anonymous user could connect to the LDAP database and, if the search scope is set to BASE, obtain access to information outside of the rootDSE. The 'rootdse' option exists to provide anonymous access to the rootDSE but no other entries in the directory. An administrator could believe that directory entries are being restricted with this option enabled, however the information provided would be the same as if 'nsslapd-allow-anonymous-access' were set to 'on'. ACI's are still properly evaluated despite this flaw, so this can easily be mitigated by removing the anonymous read ACL.
Credit: secalert@redhat.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Fedoraproject 389 Directory Server | =1.2.1 | |
| Fedoraproject 389 Directory Server | =1.2.2 | |
| Fedoraproject 389 Directory Server | =1.2.3 | |
| Fedoraproject 389 Directory Server | =1.2.5 | |
| Fedoraproject 389 Directory Server | =1.2.5-rc1 | |
| Fedoraproject 389 Directory Server | =1.2.5-rc2 | |
| Fedoraproject 389 Directory Server | =1.2.5-rc3 | |
| Fedoraproject 389 Directory Server | =1.2.5-rc4 | |
| Fedoraproject 389 Directory Server | =1.2.6 | |
| Fedoraproject 389 Directory Server | =1.2.6-a2 | |
| Fedoraproject 389 Directory Server | =1.2.6-a3 | |
| Fedoraproject 389 Directory Server | =1.2.6-a4 | |
| Fedoraproject 389 Directory Server | =1.2.6-rc1 | |
| Fedoraproject 389 Directory Server | =1.2.6-rc2 | |
| Fedoraproject 389 Directory Server | =1.2.6-rc3 | |
| Fedoraproject 389 Directory Server | =1.2.6-rc6 | |
| Fedoraproject 389 Directory Server | =1.2.6-rc7 | |
| Fedoraproject 389 Directory Server | =1.2.6.1 | |
| Fedoraproject 389 Directory Server | =1.2.7-alpha3 | |
| Fedoraproject 389 Directory Server | =1.2.7.5 | |
| Fedoraproject 389 Directory Server | =1.2.8-alpha1 | |
| Fedoraproject 389 Directory Server | =1.2.8-alpha2 | |
| Fedoraproject 389 Directory Server | =1.2.8-alpha3 | |
| Fedoraproject 389 Directory Server | =1.2.8-rc1 | |
| Fedoraproject 389 Directory Server | =1.2.8-rc2 | |
| Fedoraproject 389 Directory Server | =1.2.8.1 | |
| Fedoraproject 389 Directory Server | =1.2.8.2 | |
| Fedoraproject 389 Directory Server | =1.2.8.3 | |
| Fedoraproject 389 Directory Server | =1.2.9.9 | |
| Fedoraproject 389 Directory Server | =1.2.10 | |
| Fedoraproject 389 Directory Server | =1.2.10-alpha8 | |
| Fedoraproject 389 Directory Server | =1.2.10-rc1 | |
| Fedoraproject 389 Directory Server | =1.2.10.2 | |
| Fedoraproject 389 Directory Server | =1.2.10.3 | |
| Fedoraproject 389 Directory Server | =1.2.10.4 | |
| Fedoraproject 389 Directory Server | =1.2.10.11 | |
| Fedoraproject 389 Directory Server | =1.2.11.1 | |
| Fedoraproject 389 Directory Server | =1.2.11.5 | |
| Fedoraproject 389 Directory Server | =1.2.11.6 | |
| Fedoraproject 389 Directory Server | =1.2.11.8 | |
| Fedoraproject 389 Directory Server | =1.2.11.9 | |
| Fedoraproject 389 Directory Server | =1.2.11.10 | |
| Fedoraproject 389 Directory Server | =1.2.11.11 | |
| Fedoraproject 389 Directory Server | =1.2.11.12 | |
| Fedoraproject 389 Directory Server | =1.2.11.13 | |
| Fedoraproject 389 Directory Server | =1.2.11.14 | |
| Fedoraproject 389 Directory Server | =1.2.11.15 | |
| Fedoraproject 389 Directory Server | =1.2.11.17 | |
| Fedoraproject 389 Directory Server | =1.2.11.19 | |
| Fedoraproject 389 Directory Server | =1.3.0.2 | |
| Fedoraproject 389 Directory Server | =1.3.0.3 | |
| Fedoraproject 389 Directory Server | =1.3.0.4 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- http://git.fedorahosted.org/cgit/389/ds.git/commit/?h=389-ds-base-1.2.11&id=5a18c828533a670e7143327893f8171a19062286
- https://fedorahosted.org/389/ticket/47308
- https://bugzilla.redhat.com/show_bug.cgi/show_bug.cgi?id=928945
- https://bugzilla.redhat.com/show_bug.cgi/show_bug.cgi?id=928948
- https://fedorahosted.org/freeipa/ticket/3540
- https://rhn.redhat.com/errata/RHSA-2013-0742.html
- https://bugzilla.redhat.com/show_bug.cgi?id=928105
- http://lists.fedoraproject.org/pipermail/package-announce/2013-April/101323.html
- http://rhn.redhat.com/errata/RHSA-2013-0742.html
- https://git.fedorahosted.org/cgit/389/ds.git/commit/?h=389-ds-base-1.2.11&id=5a18c828533a670e7143327893f8171a19062286
- collector/nvd-index
- agent/type
- agent/softwarecombine
- agent/first-publish-date
- collector/mitre-cve
- source/MITRE
- agent/author
- agent/weakness
- agent/references
- agent/severity
- agent/last-modified-date
- agent/description
- agent/event
- collector/redhat-bugzilla
- source/Red Hat
- alias/CVE-2013-1897
- agent/tags
- agent/trending
- vendor/fedoraproject
- canonical/fedoraproject 389 directory server
- version/fedoraproject 389 directory server/1.2.1
- version/fedoraproject 389 directory server/1.2.2
- version/fedoraproject 389 directory server/1.2.3
- version/fedoraproject 389 directory server/1.2.5
- version/fedoraproject 389 directory server/1.2.5-rc1
- version/fedoraproject 389 directory server/1.2.5-rc2
- version/fedoraproject 389 directory server/1.2.5-rc3
- version/fedoraproject 389 directory server/1.2.5-rc4
- version/fedoraproject 389 directory server/1.2.6
- version/fedoraproject 389 directory server/1.2.6-a2
- version/fedoraproject 389 directory server/1.2.6-a3
- version/fedoraproject 389 directory server/1.2.6-a4
- version/fedoraproject 389 directory server/1.2.6-rc1
- version/fedoraproject 389 directory server/1.2.6-rc2
- version/fedoraproject 389 directory server/1.2.6-rc3
- version/fedoraproject 389 directory server/1.2.6-rc6
- version/fedoraproject 389 directory server/1.2.6-rc7
- version/fedoraproject 389 directory server/1.2.6.1
- version/fedoraproject 389 directory server/1.2.7-alpha3
- version/fedoraproject 389 directory server/1.2.7.5
- version/fedoraproject 389 directory server/1.2.8-alpha1
- version/fedoraproject 389 directory server/1.2.8-alpha2
- version/fedoraproject 389 directory server/1.2.8-alpha3
- version/fedoraproject 389 directory server/1.2.8-rc1
- version/fedoraproject 389 directory server/1.2.8-rc2
- version/fedoraproject 389 directory server/1.2.8.1
- version/fedoraproject 389 directory server/1.2.8.2
- version/fedoraproject 389 directory server/1.2.8.3
- version/fedoraproject 389 directory server/1.2.9.9
- version/fedoraproject 389 directory server/1.2.10
- version/fedoraproject 389 directory server/1.2.10-alpha8
- version/fedoraproject 389 directory server/1.2.10-rc1
- version/fedoraproject 389 directory server/1.2.10.2
- version/fedoraproject 389 directory server/1.2.10.3
- version/fedoraproject 389 directory server/1.2.10.4
- version/fedoraproject 389 directory server/1.2.10.11
- version/fedoraproject 389 directory server/1.2.11.1
- version/fedoraproject 389 directory server/1.2.11.5
- version/fedoraproject 389 directory server/1.2.11.6
- version/fedoraproject 389 directory server/1.2.11.8
- version/fedoraproject 389 directory server/1.2.11.9
- version/fedoraproject 389 directory server/1.2.11.10
- version/fedoraproject 389 directory server/1.2.11.11
- version/fedoraproject 389 directory server/1.2.11.12
- version/fedoraproject 389 directory server/1.2.11.13
- version/fedoraproject 389 directory server/1.2.11.14
- version/fedoraproject 389 directory server/1.2.11.15
- version/fedoraproject 389 directory server/1.2.11.17
- version/fedoraproject 389 directory server/1.2.11.19
- version/fedoraproject 389 directory server/1.3.0.2
- version/fedoraproject 389 directory server/1.3.0.3
- version/fedoraproject 389 directory server/1.3.0.4