LDAP: Red Hat 389 Directory Server ns-slapd ldapsearch Buffer Overflow

This signature detects attempt to exploit a stack buffer overflow vulnerability which has been discovered in 389 Directory Server. A remote attacker can issue a crafted query in order to trigger the vulnerability and cause cause arbitrary code execution with the privileges of the ns-slapd daemon. An unsuccessful attack will cause the ns-slapd daemon to abnormally terminate.

Extended Description

389-ds-base before versions 1.4.0.9, 1.3.8.1, 1.3.6.15 did not properly handle long search filters with characters needing escapes, possibly leading to buffer overflows. A remote, unauthenticated attacker could potentially use this flaw to make ns-slapd crash via a specially crafted LDAP request, thus resulting in denial of service.

Affected Products

Redhat enterprise_linux_workstation

References

CVE: CVE-2018-1089

Short Name

LDAP:REDHAT-SLAPD-SRCH-BO

Severity

Major

Recommended

True

Recommended Action

Drop

LDAP: Red Hat 389 Directory Server ns-slapd ldapsearch Buffer Overflow

Extended Description

Affected Products

References

Found a potential security threat?