CVE-2017-2591: High severity red hat 389 directory server vulnerability
389-ds-base before version 1.3.6 is vulnerable to an improperly NULL terminated array in the uniquenessentrytoconfig() function in the "attribute uniqueness" plugin of 389 Directory Server. An authenticated, or possibly unauthenticated, attacker could use this flaw to force an out-of-bound heap memory read, possibly triggering a crash of the LDAP service.
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is the vulnerability ID for this vulnerability?
The vulnerability ID for this vulnerability is CVE-2017-2591.
What is the severity of CVE-2017-2591?
The severity of CVE-2017-2591 is high with a severity value of 7.5.
Which software versions are affected by CVE-2017-2591?
389-ds-base before version 1.3.6 and Redhat Enterprise Linux 7.0 are affected by CVE-2017-2591.
How does CVE-2017-2591 work?
CVE-2017-2591 is caused by an improperly NULL terminated array in the uniqueness_entry_to_config() function in the "attribute uniqueness" plugin of 389 Directory Server, which allows an attacker to force an out-of-bound heap memory access.
Are there any references available for CVE-2017-2591?
Yes, you can find references for CVE-2017-2591 at the following links: [SecurityFocus](http://www.securityfocus.com/bid/95670), [Red Hat Bugzilla](https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2017-2591), [Pagure.io](https://pagure.io/389-ds-base/issue/48986).