Описание
A flaw was found in 389 Directory Server. A missing NULL pointer check in the paged results handling of op_shared_search allows an unauthenticated remote attacker to crash the LDAP server by sending a crafted sequence of search requests using the USE_ONE_BACKEND control, resulting in denial of service.
Отчет
This issue is rated Important because a remote attacker with network access to the LDAP service can crash the directory server process without authenticating, under default configuration. Successful exploitation completely stops directory lookups and authentication that depend on this service until the process is restarted, and the attack is easy to repeat. There is no impact on confidentiality or integrity: the fault is a crash only and does not leak or modify directory data. Environments that disable anonymous LDAP access remove the unauthenticated path, but any authenticated client that can send search requests can still trigger the same crash. Deployments that expose LDAP only to trusted networks reduce the practical attack surface, but do not change the underlying impact when a client can reach the service.
Меры по смягчению последствий
Red Hat has investigated whether a possible mitigation exists for this issue, and has not been able to identify a practical example. Please update the affected package as soon as possible.
Затронутые пакеты
| Платформа | Пакет | Состояние | Рекомендация | Релиз |
|---|---|---|---|---|
| Red Hat Directory Server 12 | redhat-ds:12/389-ds-base | Affected | ||
| Red Hat Directory Server 13 | 389-ds-base | Not affected | ||
| Red Hat Enterprise Linux 6 | 389-ds-base | Out of support scope | ||
| Red Hat Directory Server 11.7 E4S for RHEL 8 | redhat-ds | Fixed | RHSA-2026:64792 | 08.09.2026 |
| Red Hat Directory Server 11.9 for RHEL 8 | redhat-ds | Fixed | RHSA-2026:64793 | 08.09.2026 |
| Red Hat Directory Server 12.2 E4S for RHEL 9 | redhat-ds | Fixed | RHSA-2026:64779 | 08.09.2026 |
| Red Hat Directory Server 12.4 E4S for RHEL 9 | redhat-ds | Fixed | RHSA-2026:64780 | 08.09.2026 |
| Red Hat Enterprise Linux 10 | 389-ds-base | Fixed | RHSA-2026:64785 | 08.09.2026 |
| Red Hat Enterprise Linux 10.0 Extended Update Support | 389-ds-base | Fixed | RHSA-2026:64804 | 08.09.2026 |
| Red Hat Enterprise Linux 7 Extended Lifecycle Support | 389-ds-base | Fixed | RHSA-2026:64771 | 08.09.2026 |
Показывать по
Дополнительная информация
Статус:
EPSS
7.5 High
CVSS3
Связанные уязвимости
A flaw was found in 389 Directory Server. A missing NULL pointer check in the paged results handling of op_shared_search allows an unauthenticated remote attacker to crash the LDAP server by sending a crafted sequence of search requests using the USE_ONE_BACKEND control, resulting in denial of service.
A flaw was found in 389 Directory Server. A missing NULL pointer check in the paged results handling of op_shared_search allows an unauthenticated remote attacker to crash the LDAP server by sending a crafted sequence of search requests using the USE_ONE_BACKEND control, resulting in denial of service.
A flaw was found in 389 Directory Server. A missing NULL pointer check ...
A flaw was found in 389 Directory Server. A missing NULL pointer check in the paged results handling of op_shared_search allows an unauthenticated remote attacker to crash the LDAP server by sending a crafted sequence of search requests using the USE_ONE_BACKEND control, resulting in denial of service.
EPSS
7.5 High
CVSS3