REDHAT-BUG-2485422: Medium severity Red Hat 389 Directory Server vulnerability
The SMD5 password storage plugin in 389 Directory Server computes salt length by subtracting MD5LENGTH (16) from the decoded hash length using unsigned 32-bit arithmetic. When the stored hash is shorter than 16 bytes, the subtraction wraps to approximately 4GB. PK11DigestOp() then reads from a small stack buffer into unmapped memory, crashing ns-slapd with SIGSEGV.
An attacker with Directory Manager privileges plants a crafted SMD5 hash; any subsequent BIND triggers instant crash. Missed variant of CVE-2024-5953 which patched md5pwd.c and pbkdf2pwd.c but not smd5pwd.c.
Present since smd5pwd.c creation (~2005). PoC confirmed on Fedora 42 production binary.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
389 Directory Server (SMD5 password storage plugin / smd5_pwd.c)to a version that resolves this vulnerability.Patch CVE-2024-5953 - Compensating control
Until patched, prevent untrusted users from obtaining or using Directory Manager privileges to plant a crafted SMD5 hash in 389 Directory Server.
- Operational
After applying the fix, verify ns-slapd stability and check for any already-planted malformed SMD5 hashes that could trigger repeated crashes.
Event History
Frequently Asked Questions
What is the severity of REDHAT-BUG-2485422?
The severity of REDHAT-BUG-2485422 is classified as medium, rated at 4.
How do I fix REDHAT-BUG-2485422?
To fix REDHAT-BUG-2485422, ensure that you apply the latest updates provided by Red Hat for the 389 Directory Server.
What software is affected by REDHAT-BUG-2485422?
REDHAT-BUG-2485422 affects the Red Hat 389 Directory Server.
What is the risk associated with REDHAT-BUG-2485422?
The risk associated with REDHAT-BUG-2485422 is rated as 19, indicating a significant security concern.
What is the main issue in REDHAT-BUG-2485422?
The main issue in REDHAT-BUG-2485422 is improper salt length computation in the SMD5 password storage plugin, which can lead to vulnerabilities.