CVE-2014-3562: Infoleak

Published Jul 25, 2014

Updated

IssueDescription:

It was found that when replication was enabled for each attribute in Red Hat Directory Server / 389 Directory Server, which is the default configuration, the server returned replicated metadata when the directory was searched while debugging was enabled. A remote attacker could use this flaw to disclose potentially sensitive information.

Acknowledgements:

This issue was discovered by Ludwig Krispenz of Red Hat.

Other sources

Red Hat Directory Server 8 and 389 Directory Server, when debugging is enabled, allows remote attackers to obtain sensitive replicated metadata by searching the directory.

— MITRE

Affected Software

65 affected components

Fedoraproject 389 Directory Server=1.2.1

Fedoraproject 389 Directory Server=1.2.2

Fedoraproject 389 Directory Server=1.2.3

Fedoraproject 389 Directory Server=1.2.5

Fedoraproject 389 Directory Server=1.2.5-rc1

Fedoraproject 389 Directory Server=1.2.5-rc2

Fedoraproject 389 Directory Server=1.2.5-rc3

Fedoraproject 389 Directory Server=1.2.5-rc4

Fedoraproject 389 Directory Server=1.2.6

Fedoraproject 389 Directory Server=1.2.6-a2

Fedoraproject 389 Directory Server=1.2.6-a3

Fedoraproject 389 Directory Server=1.2.6-a4

Fedoraproject 389 Directory Server=1.2.6-rc1

Fedoraproject 389 Directory Server=1.2.6-rc2

Fedoraproject 389 Directory Server=1.2.6-rc3

Fedoraproject 389 Directory Server=1.2.6-rc6

Fedoraproject 389 Directory Server=1.2.6-rc7

Fedoraproject 389 Directory Server=1.2.6.1

Fedoraproject 389 Directory Server=1.2.7-alpha3

Fedoraproject 389 Directory Server=1.2.7.5

Fedoraproject 389 Directory Server=1.2.8-alpha1

Fedoraproject 389 Directory Server=1.2.8-alpha2

Fedoraproject 389 Directory Server=1.2.8-alpha3

Fedoraproject 389 Directory Server=1.2.8-rc1

Fedoraproject 389 Directory Server=1.2.8-rc2

Fedoraproject 389 Directory Server=1.2.8.1

Fedoraproject 389 Directory Server=1.2.8.2

Fedoraproject 389 Directory Server=1.2.8.3

Fedoraproject 389 Directory Server=1.2.9.9

Fedoraproject 389 Directory Server=1.2.10

Fedoraproject 389 Directory Server=1.2.10-alpha8

Fedoraproject 389 Directory Server=1.2.10-rc1

Fedoraproject 389 Directory Server=1.2.10.2

Fedoraproject 389 Directory Server=1.2.10.3

Fedoraproject 389 Directory Server=1.2.10.4

Fedoraproject 389 Directory Server=1.2.10.11

Fedoraproject 389 Directory Server=1.2.11.1

Fedoraproject 389 Directory Server=1.2.11.5

Fedoraproject 389 Directory Server=1.2.11.6

Fedoraproject 389 Directory Server=1.2.11.8

Fedoraproject 389 Directory Server=1.2.11.9

Fedoraproject 389 Directory Server=1.2.11.10

Fedoraproject 389 Directory Server=1.2.11.11

Fedoraproject 389 Directory Server=1.2.11.12

Fedoraproject 389 Directory Server=1.2.11.13

Fedoraproject 389 Directory Server=1.2.11.14

Fedoraproject 389 Directory Server=1.2.11.15

Fedoraproject 389 Directory Server=1.2.11.17

Fedoraproject 389 Directory Server=1.2.11.19

Fedoraproject 389 Directory Server=1.2.11.20

Fedoraproject 389 Directory Server=1.2.11.21

Fedoraproject 389 Directory Server=1.2.11.22

Fedoraproject 389 Directory Server=1.2.11.23

Fedoraproject 389 Directory Server=1.2.11.25

Fedoraproject 389 Directory Server=1.2.11.26

Fedoraproject 389 Directory Server=1.3.0.2

Fedoraproject 389 Directory Server=1.3.0.3

Fedoraproject 389 Directory Server=1.3.0.4

Fedoraproject 389 Directory Server=1.3.0.5

Fedoraproject 389 Directory Server=1.3.0.6

Fedoraproject 389 Directory Server=1.3.0.7

Fedoraproject 389 Directory Server=1.3.0.8

redhat Directory Server=8.0

redhat Enterprise Linux=6.0

redhat Enterprise Linux=7.0

Event History

Jul 25, 2014

Data Sourced

via Red Hat·07:22 PM

DescriptionSeverityAffected Software

Aug 21, 2014

CVE Published

via MITRE·02:00 PM

Data Sourced

via MITRE·02:00 PM

Description

Frequently Asked Questions

What is the severity of CVE-2014-3562?

CVE-2014-3562 has a medium severity rating due to potential unauthorized access to sensitive replicated metadata.

How do I fix CVE-2014-3562?

To fix CVE-2014-3562, update your Red Hat Directory Server to the latest version that includes the security patches for this vulnerability.

Which versions of Red Hat Directory Server are affected by CVE-2014-3562?

CVE-2014-3562 affects Red Hat Directory Server versions 1.2.1 through 1.2.10.4 and 1.3.0.2 through 1.3.0.8.

Can CVE-2014-3562 be exploited remotely?

Yes, CVE-2014-3562 can be exploited remotely by an attacker if debugging is enabled.

What type of information can an attacker access through CVE-2014-3562?

An attacker exploiting CVE-2014-3562 could gain access to sensitive replicated metadata during directory searches.