REDHAT-BUG-454662: High severity red hat adminutil vulnerability
adminutil is a library of common functions used by multiple CGI scripts shipped with Red Hat / Fedora Directory Server.
It was discovered that adminutil HTTP unescaping functions did not properly handle %-encoded inputs, resulting in a miscalculation of memory requirement needed to hold processed string with special characters replaced with HTML entities. This resulted in a heap-based overflow. An attacker with access to certain Directory Server's CGI scripts could use this flaw to crash or possibly execute arbitrary code with the privileges of the Directory Server Administration Server (unprivileged user, nobody by default, in affected Directory Server versions).
Problem was introduced by a bug fix included in adminutil 1.1.6, affected packages were only shipped in Fedora.
Red Hat Directory Server 7.1 and 8 did not contain vulnerable code.
Affected Software
Event History
Frequently Asked Questions
What is the severity of REDHAT-BUG-454662?
The severity of REDHAT-BUG-454662 is considered high due to the potential for memory mismanagement and application crashes.
How do I fix REDHAT-BUG-454662?
To fix REDHAT-BUG-454662, update the adminutil library to a version greater than 1.1.6.
What versions of adminutil are affected by REDHAT-BUG-454662?
Versions of Red Hat adminutil prior to 1.1.6 are affected by REDHAT-BUG-454662.
What are the implications of REDHAT-BUG-454662 for system security?
REDHAT-BUG-454662 can lead to remote code execution or denial of service if exploited, compromising system security.
Is there a workaround for REDHAT-BUG-454662?
As a workaround for REDHAT-BUG-454662, consider disabling the affected CGI scripts until the library can be updated.