CVE-2017-2591
First published: Mon Apr 30 2018(Updated: )
389-ds-base before version 1.3.6 is vulnerable to an improperly NULL terminated array in the uniqueness_entry_to_config() function in the "attribute uniqueness" plugin of 389 Directory Server. An authenticated, or possibly unauthenticated, attacker could use this flaw to force an out-of-bound heap memory read, possibly triggering a crash of the LDAP service.
Credit: secalert@redhat.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Fedoraproject 389 Directory Server | <1.3.6 | |
| Redhat Enterprise Linux | =7.0 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is the vulnerability ID for this vulnerability?
The vulnerability ID for this vulnerability is CVE-2017-2591.
What is the severity of CVE-2017-2591?
The severity of CVE-2017-2591 is high with a severity value of 7.5.
Which software versions are affected by CVE-2017-2591?
389-ds-base before version 1.3.6 and Redhat Enterprise Linux 7.0 are affected by CVE-2017-2591.
How does CVE-2017-2591 work?
CVE-2017-2591 is caused by an improperly NULL terminated array in the uniqueness_entry_to_config() function in the "attribute uniqueness" plugin of 389 Directory Server, which allows an attacker to force an out-of-bound heap memory access.
Are there any references available for CVE-2017-2591?
Yes, you can find references for CVE-2017-2591 at the following links: [SecurityFocus](http://www.securityfocus.com/bid/95670), [Red Hat Bugzilla](https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2017-2591), [Pagure.io](https://pagure.io/389-ds-base/issue/48986).
- collector/nvd-index
- agent/references
- agent/weakness
- agent/severity
- agent/author
- agent/type
- agent/description
- agent/event
- agent/last-modified-date
- agent/remedy
- agent/softwarecombine
- agent/first-publish-date
- agent/tags
- collector/mitre-cve
- source/MITRE
- vendor/fedoraproject
- canonical/fedoraproject 389 directory server
- vendor/redhat
- canonical/redhat enterprise linux
- version/redhat enterprise linux/7.0