REDHAT-BUG-2484914: Buffer Overflow
A stack buffer overflow exists in 389 Directory Server's checkPrefix() function (pw.c:440-466). When parsing reversible-encrypted attribute values in the format {SCHEME-<algid>}ciphertext, the algorithm ID is copied into a 256-byte stack buffer via memcpy with no bounds check on (end - delim).
An attacker with Directory Manager privileges can crash ns-slapd by storing a crafted nsDS5ReplicaCredentials (or similar reversible-encrypted config attribute) with an oversized algorithm ID. FORTIFYSOURCE (memcpychk) aborts the process before overflow bytes are written, limiting impact to DoS (SIGABRT) only. Code execution is not possible on production builds.
Production crashes confirmed on RHEL 7 (389-ds-base-1.3.11.1-5.el79) and Fedora 42 (389-ds-base-3.1.4-6.fc42). RHEL 8 crash confirmed via dse.ldif injection (389-ds-base-1.4.3.39-2.moduleel8).
Note: cn=config is local configuration and not replicated; triggering requires Directory Manager access on the target server.
Advisory: 389-ds-campaign-2026-04/003-Stack-Overflow-checkPrefix/advisory.md. Source: PSIRTSUPT-7600 (Ian Murphy, Red Hat Product Security).
Affected Software
Event History
Frequently Asked Questions
What is the severity of REDHAT-BUG-2484914?
The severity of REDHAT-BUG-2484914 is categorized as low.
What kind of vulnerability is REDHAT-BUG-2484914?
REDHAT-BUG-2484914 is a stack buffer overflow vulnerability.
How can I fix REDHAT-BUG-2484914?
To mitigate REDHAT-BUG-2484914, update to the latest version of Red Hat 389-ds-base that addresses this vulnerability.
In which function does the vulnerability REDHAT-BUG-2484914 occur?
The vulnerability REDHAT-BUG-2484914 occurs in the checkPrefix() function.
What is the impact of exploiting REDHAT-BUG-2484914?
Exploiting REDHAT-BUG-2484914 could potentially lead to a buffer overflow, which might compromise application stability.