CVE-2025-14905: 389-ds-base: 389-ds-base: remote code execution and denial of service via heap buffer overflow
A flaw was found in the 389-ds-base server. A heap buffer overflow vulnerability exists in the schemaattrenumcallback function within the schema.c file. This occurs because the code incorrectly calculates the buffer size by summing alias string lengths without accounting for additional formatting characters. When a large number of aliases are processed, this oversight can lead to a heap overflow, potentially allowing a remote attacker to cause a Denial of Service (DoS) or achieve Remote Code Execution (RCE).
Other sources
A vulnerability was found in the ds-389-base server, specifically in the schema.c file which was then verified as exploitable in the running server. There is a heap buffer overflow that can be exploited to execute a DoS and potential RCE. The vulnerability is possible through the function schemaattrenumcallback, the code calculates size by summing the lengths of alias strings but fails to account for the formatting characters added during printing. It relies on a static "magic number" of 256 to absorb this overhead. When the number of aliases is large enough, the cumulative overhead of 3 bytes per alias exceeds the 256-byte margin, leading to a heap overflow.
— Red Hat
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2025-14905?
The severity of CVE-2025-14905 is critical due to its potential for remote code execution and denial of service.
How do I fix CVE-2025-14905?
To fix CVE-2025-14905, upgrade to the latest version of 389-ds-base that addresses this vulnerability.
What systems are affected by CVE-2025-14905?
CVE-2025-14905 affects the 389-ds-base server, specifically versions of Red Hat's 389-ds-base without the patch.
What is the impact of CVE-2025-14905?
The impact of CVE-2025-14905 includes the risk of remote code execution and the possibility of a denial of service attack.
Which specific function is responsible for the vulnerability CVE-2025-14905?
The vulnerability CVE-2025-14905 is caused by a heap buffer overflow in the `schema_attr_enum_callback` function within the `schema.c` file.