CVE-2014-8112: Infoleak

Published Dec 10, 2014

Updated

389 Directory Server 1.3.1.x, 1.3.2.x before 1.3.2.27, and 1.3.3.x before 1.3.3.9 stores "unhashed" passwords even when the nsslapd-unhashed-pw-switch option is set to off, which allows remote authenticated users to obtain sensitive information by reading the Changelog.

Other sources

Ludwig Krispenz from Red Hat reported that there is a configuration switch to prevent writing unhashed passwords into the changelogs. Unfortunately if the switch is turned on the attribute unhashed#user#password is not written to the changelog, but the hashing of the attribute value itself is also bypassed.

Versions affected are 389 versions 1.3.1 and later, this means RHEL7.0 and later and Fedora20 and later.

The severity seems to be limited, since: - the option is not widely known and advertised and only available in a recent version - the access to the userpassword attribute is usually protected by acis not to be readable

Statement:

This issue did not affect the versions of 389-ds-base as shipped with Red Hat Enterprise Linux 6.

— Red Hat

Affected Software

44 affected components

Red Hat 389 Directory Server=1.3.1.0

Red Hat 389 Directory Server=1.3.1.1

Red Hat 389 Directory Server=1.3.1.2

Red Hat 389 Directory Server=1.3.1.3

Red Hat 389 Directory Server=1.3.1.4

Red Hat 389 Directory Server=1.3.1.5

Red Hat 389 Directory Server=1.3.1.6

Red Hat 389 Directory Server=1.3.1.7

Red Hat 389 Directory Server=1.3.1.8

Red Hat 389 Directory Server=1.3.1.9

Red Hat 389 Directory Server=1.3.1.10

Red Hat 389 Directory Server=1.3.1.11

Red Hat 389 Directory Server=1.3.1.12

Red Hat 389 Directory Server=1.3.1.13

Red Hat 389 Directory Server=1.3.1.14

Red Hat 389 Directory Server=1.3.1.15

Red Hat 389 Directory Server=1.3.1.16

Red Hat 389 Directory Server=1.3.1.17

Red Hat 389 Directory Server=1.3.1.18

Red Hat 389 Directory Server=1.3.1.19

Red Hat 389 Directory Server=1.3.1.22

Red Hat 389 Directory Server=1.3.2.2

Red Hat 389 Directory Server=1.3.2.3

Red Hat 389 Directory Server=1.3.2.4

Red Hat 389 Directory Server=1.3.2.5

Red Hat 389 Directory Server=1.3.2.6

Red Hat 389 Directory Server=1.3.2.7

Red Hat 389 Directory Server=1.3.2.8

Red Hat 389 Directory Server=1.3.2.9

Red Hat 389 Directory Server=1.3.2.10

Red Hat 389 Directory Server=1.3.2.11

Red Hat 389 Directory Server=1.3.2.13

Red Hat 389 Directory Server=1.3.2.16

Red Hat 389 Directory Server=1.3.2.19

Red Hat 389 Directory Server=1.3.2.22

Red Hat 389 Directory Server=1.3.2.23

Red Hat 389 Directory Server=1.3.2.24

Red Hat 389 Directory Server=1.3.2.26

Red Hat 389 Directory Server=1.3.3.0

Red Hat 389 Directory Server=1.3.3.2

Red Hat 389 Directory Server=1.3.3.3

Red Hat 389 Directory Server=1.3.3.5

Red Hat 389 Directory Server=1.3.3.8

fedoraproject fedora=22

Event History

Dec 10, 2014

Data Sourced

via Red Hat·03:54 PM

DescriptionSeverityAffected Software

Mar 10, 2015

CVE Published

via MITRE·02:00 PM

Data Sourced

via MITRE·02:00 PM

Description

Frequently Asked Questions

What is the severity of CVE-2014-8112?

CVE-2014-8112 is considered a medium severity vulnerability due to its potential to expose unhashed passwords.

How do I fix CVE-2014-8112?

To fix CVE-2014-8112, upgrade to 389 Directory Server version 1.3.2.27 or later or 1.3.3.9 or later.

Who is affected by CVE-2014-8112?

CVE-2014-8112 affects various versions of the Red Hat 389 Directory Server prior to the specified patched releases.

What does CVE-2014-8112 exploit?

CVE-2014-8112 exploits improper handling of password storage, leading to potential exposure of sensitive information.

Is there a workaround for CVE-2014-8112?

There is no definitive workaround for CVE-2014-8112; upgrading the software is the recommended solution.