Bug 1209573 (CVE-2015-1854)

Summary: CVE-2015-1854 389-ds-base: access control bypass with modrdn
Product: [Other] Security Response Reporter: Vasyl Kaigorodov <vkaigoro>
Component: vulnerabilityAssignee: Red Hat Product Security <security-response-team>
Status: CLOSED ERRATA QA Contact: Viktor Ashirov <vashirov>
Severity: high Docs Contact:
Priority: high    
Version: unspecifiedCC: bressers, jrusnack, mreynolds, nhosoi, nkinder, security-response-team, ssorce, tbordaz, twalsh, vashirov
Target Milestone: ---Keywords: Security
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard: impact=important,public=20150428,reported=20150407,source=redhat,cvss2=4.8/AV:A/AC:L/Au:N/C:N/I:P/A:P,cwe=CWE-697->CWE-863,directory_server_8/redhat-ds-base=notaffected,rhel-6/389-ds-base=notaffected,rhel-7/389-ds-base=affected,fedora-all/389-ds-base=affected
Fixed In Version: Doc Type: Bug Fix
Doc Text:
A flaw was found in the way Red Hat Directory Server performed authorization of modrdn operations. An unauthenticated attacker able to issue an ldapmodrdn call to the directory server could use this flaw to perform unauthorized modifications of entries in the directory server.
Story Points: ---
Clone Of: Environment:
Last Closed: 2015-04-28 18:31:07 UTC Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: ---
Bug Depends On: 1212894, 1212895, 1216203    
Bug Blocks: 1209577    

Description Vasyl Kaigorodov 2015-04-07 16:48:51 UTC
An access control bypass flaw was found in modrdn. In particular if a user has a rdn like uid=username, then the user can change its own rdn to any value that is a superstring of the current name bypassing access control.

This issue could be reproduced by the following:

ldapmodrnd -Y GSSAPI -r uid=testuser,cn=users,cn=accounts,dc=test,dc=ipa uid=testuser_extended_without_permission

The above succeeds and renames the user.

No authentication whatsoever is necessary. An anonymous user can completely hose a server (if not worse) by just renaming any entry it pleases.

If ACIs are employed to hide entries and those entries are targeted by
name then it is also possible to reveal those contents by renaming the
entry and falling off the ACI protection.


Acknowledgements:

This issue was discovered by Simo Sorce of Red Hat.

Comment 10 Huzaifa S. Sidhpurwala 2015-04-24 07:52:16 UTC
Statement:

This issue does not affect the version of 389-ds-base package as shipped with Red Hat Enterprise Linux 6.

Comment 11 Simo Sorce 2015-04-24 18:00:51 UTC
I think Noriko is better suited to answer questions about embargo lifting.

Comment 15 errata-xmlrpc 2015-04-28 18:18:29 UTC
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 7

Via RHSA-2015:0895 https://rhn.redhat.com/errata/RHSA-2015-0895.html

Comment 16 Ján Rusnačko 2015-04-28 18:26:50 UTC
Created 389-ds-base tracking bugs for this issue:

Affects: fedora-all [bug 1216203]