CVE-2015-1854: High severity Fedoraproject 389 Directory Server vulnerability
389 Directory Server before 1.3.3.10 allows attackers to bypass intended access restrictions and modify directory entries via a crafted ldapmodrdn call.
Other sources
An access control bypass flaw was found in modrdn. In particular if a user has a rdn like uid=username, then the user can change its own rdn to any value that is a superstring of the current name bypassing access control.
This issue could be reproduced by the following:
ldapmodrnd -Y GSSAPI -r uid=testuser,cn=users,cn=accounts,dc=test,dc=ipa uid=testuserextendedwithoutpermission
The above succeeds and renames the user.
No authentication whatsoever is necessary. An anonymous user can completely hose a server (if not worse) by just renaming any entry it pleases.
If ACIs are employed to hide entries and those entries are targeted by name then it is also possible to reveal those contents by renaming the entry and falling off the ACI protection.
Acknowledgements:
This issue was discovered by Simo Sorce of Red Hat.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2015-1854?
CVE-2015-1854 is classified as a medium severity vulnerability due to its potential for unauthorized modification of directory entries.
How do I fix CVE-2015-1854?
To fix CVE-2015-1854, update to 389 Directory Server version 1.3.3.10 or later to ensure the access control bypass is mitigated.
Which software versions are affected by CVE-2015-1854?
CVE-2015-1854 affects 389 Directory Server versions prior to 1.3.3.10, Fedora 22, and Debian 8.0.
What kind of attack does CVE-2015-1854 facilitate?
CVE-2015-1854 allows attackers to bypass access restrictions and alter their own directory entries via a crafted ldapmodrdn request.
Is CVE-2015-1854 related to LDAP operations?
Yes, CVE-2015-1854 specifically involves vulnerabilities in LDAP operations, particularly the modrdn command.