REDHAT-BUG-1358865
First published: Thu Jul 21 2016(Updated: )
It was found that 389 Directory Server is vulnerable to a remote password disclosure via timing attack. Due to the use of strcmp and memcmp in the verification of passwords and hashes, remote attacker is able to tell the difference between computation times which makes him able to retrieve the password after many tries. This affects systems storing passwords in plain text. Systems using unsalted hashes might be unsafe as well if using weak hash algorithms, however the attack would be very time-consuming.
| Affected Software | Affected Version | How to fix |
|---|---|---|
| 389 Directory Server |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is the severity of REDHAT-BUG-1358865?
REDHAT-BUG-1358865 is classified as a high-severity vulnerability due to its potential for unauthorized password disclosure.
How do I fix REDHAT-BUG-1358865?
To fix REDHAT-BUG-1358865, you should apply the latest patches or updates provided by Red Hat for the 389 Directory Server.
What impact does REDHAT-BUG-1358865 have on the system?
The impact of REDHAT-BUG-1358865 allows a remote attacker to exploit timing discrepancies in password verification, potentially revealing passwords.
Which versions of the 389 Directory Server are affected by REDHAT-BUG-1358865?
REDHAT-BUG-1358865 affects various versions of the Red Hat 389 Directory Server, specifically those using vulnerable strcmp and memcmp functions.
Is REDHAT-BUG-1358865 a local or remote vulnerability?
REDHAT-BUG-1358865 is a remote vulnerability, allowing attackers to exploit it from outside the local network.
- agent/type
- agent/first-publish-date
- agent/last-modified-date
- collector/redhat-bugzilla
- source/Red Hat
- alias/CVE-2016-5405
- agent/severity
- agent/references
- agent/description
- agent/event
- agent/trending
- agent/source
- agent/tags
- agent/softwarecombine
- agent/guess-ai
- agent/software-canonical-lookup
- agent/software-canonical-lookup-request
- vendor/red hat
- canonical/389 directory server