Описание
A flaw was found in 389 Directory Server. During SASL PLAIN authentication, a stale identity carried in a Cyrus SASL auxiliary property from a prior failed bind attempt can be installed on a connection following a subsequent, unrelated successful bind, regardless of which SASL mechanism completes that second bind. An attacker can send a SASL PLAIN bind as cn=Directory Manager with an incorrect password, then complete a SASL ANONYMOUS bind on the same connection, causing the server to grant Directory Manager authority without any valid credentials. A variant using a valid low-privileged account's own successful bind instead of an anonymous one is also possible.
Отчет
This flaw is rated Critical because it allows a remote, unauthenticated attacker to gain full Directory Manager privileges over an LDAPS connection — with no valid account, no user interaction, and no non-default configuration required. Flaw is exploitable by a remote unauthenticated attacker that fully compromises confidentiality, integrity, and availability without requiring user interaction.
Меры по смягчению последствий
Administrators can restrict nsslapd-allowed-sasl-mechanisms to only the mechanisms actually required (e.g. GSSAPI, EXTERNAL, GSS-SPNEGO), excluding PLAIN. Since the exploit chain requires the first bind attempt to be a failed SASL PLAIN bind as cn=Directory Manager, removing PLAIN from the allowed mechanism list prevents that step entirely — this blocks both the originally reported variant (valid low-privileged account) and the zero-credential SASL ANONYMOUS variant, since both depend on the same initial PLAIN bind to plant the stale identity.
Затронутые пакеты
| Платформа | Пакет | Состояние | Рекомендация | Релиз |
|---|---|---|---|---|
| Red Hat Directory Server 12 | 389-ds-base | Affected | ||
| Red Hat Directory Server 13 | 389-ds-base | Not affected | ||
| Red Hat Directory Server 11.7 E4S for RHEL 8 | redhat-ds | Fixed | RHSA-2026:64792 | 08.09.2026 |
| Red Hat Directory Server 11.9 for RHEL 8 | redhat-ds | Fixed | RHSA-2026:64793 | 08.09.2026 |
| Red Hat Directory Server 12.2 E4S for RHEL 9 | redhat-ds | Fixed | RHSA-2026:64779 | 08.09.2026 |
| Red Hat Directory Server 12.4 E4S for RHEL 9 | redhat-ds | Fixed | RHSA-2026:64780 | 08.09.2026 |
| Red Hat Enterprise Linux 10 | 389-ds-base | Fixed | RHSA-2026:64785 | 08.09.2026 |
| Red Hat Enterprise Linux 10.0 Extended Update Support | 389-ds-base | Fixed | RHSA-2026:64804 | 08.09.2026 |
| Red Hat Enterprise Linux 6 Extended Lifecycle Support - EXTENSION | 389-ds-base | Fixed | RHSA-2026:64811 | 08.09.2026 |
| Red Hat Enterprise Linux 7 Extended Lifecycle Support | 389-ds-base | Fixed | RHSA-2026:64771 | 08.09.2026 |
Показывать по
Дополнительная информация
Статус:
EPSS
9.8 Critical
CVSS3
Связанные уязвимости
A flaw was found in 389 Directory Server. During SASL PLAIN authentication, a stale identity carried in a Cyrus SASL auxiliary property from a prior failed bind attempt can be installed on a connection following a subsequent, unrelated successful bind, regardless of which SASL mechanism completes that second bind. An attacker can send a SASL PLAIN bind as cn=Directory Manager with an incorrect password, then complete a SASL ANONYMOUS bind on the same connection, causing the server to grant Directory Manager authority without any valid credentials. A variant using a valid low-privileged account's own successful bind instead of an anonymous one is also possible.
A flaw was found in 389 Directory Server. During SASL PLAIN authentication, a stale identity carried in a Cyrus SASL auxiliary property from a prior failed bind attempt can be installed on a connection following a subsequent, unrelated successful bind, regardless of which SASL mechanism completes that second bind. An attacker can send a SASL PLAIN bind as cn=Directory Manager with an incorrect password, then complete a SASL ANONYMOUS bind on the same connection, causing the server to grant Directory Manager authority without any valid credentials. A variant using a valid low-privileged account's own successful bind instead of an anonymous one is also possible.
A flaw was found in 389 Directory Server. During SASL PLAIN authentica ...
A flaw was found in 389 Directory Server. During SASL PLAIN authentication, a stale identity carried in a Cyrus SASL auxiliary property from a prior failed bind attempt can be installed on a connection following a subsequent, unrelated successful bind, regardless of which SASL mechanism completes that second bind. An attacker can send a SASL PLAIN bind as cn=Directory Manager with an incorrect password, then complete a SASL ANONYMOUS bind on the same connection, causing the server to grant Directory Manager authority without any valid credentials. A variant using a valid low-privileged account's own successful bind instead of an anonymous one is also possible.
EPSS
9.8 Critical
CVSS3