REDHAT-BUG-979508: Medium severity red hat directory server vulnerability
A flaw was found in how Red Hat Directory Server and the 389 Directory Server would handle access controls to certain attributes of an entry. A user with access to the Directory Server could use a series of searches to guess the values of other attributes that they should not be able to see. If a user had access (authenticated or anonymous, depending on whether or not the Directory Server allows anonymous access), they could use this to obtain information that should be restricted due to access controls.
Affected Software
Event History
Frequently Asked Questions
What is the severity of REDHAT-BUG-979508?
The severity of REDHAT-BUG-979508 is classified as moderate due to potential unauthorized access to sensitive attribute values.
How do I fix REDHAT-BUG-979508?
To fix REDHAT-BUG-979508, it is recommended to apply the latest security patches provided by Red Hat for the affected directory servers.
Who is affected by REDHAT-BUG-979508?
Users and administrators of Red Hat Directory Server and Red Hat 389 Directory Server are affected by REDHAT-BUG-979508.
What is the nature of the flaw in REDHAT-BUG-979508?
The flaw in REDHAT-BUG-979508 involves improper access control that allows users to infer other attribute values through crafted searches.
Is there a workaround for REDHAT-BUG-979508?
A workaround for REDHAT-BUG-979508 includes tightening access controls and monitoring directory access to minimize potential exploits.