Bug 2292104 (CVE-2024-5953) - CVE-2024-5953 389-ds-base: Malformed userPassword hash may cause Denial of Service
Summary: CVE-2024-5953 389-ds-base: Malformed userPassword hash may cause Denial of Se...
Keywords:
Status: NEW
Alias: CVE-2024-5953
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
medium
medium
Target Milestone: ---
Assignee: Product Security
QA Contact:
URL:
Whiteboard:
Depends On: 2292131 2292109 2292130
Blocks: 2292103
TreeView+ depends on / blocked
 
Reported: 2024-06-13 04:22 UTC by Patrick Del Bello
Modified: 2024-09-11 06:35 UTC (History)
8 users (show)

Fixed In Version:
Doc Type: If docs needed, set a value
Doc Text:
A denial of service vulnerability was found in the 389-ds-base LDAP server. This issue may allow an authenticated user to cause a server denial of service while attempting to log in with a user with a malformed hash in their password.
Clone Of:
Environment:
Last Closed:
Embargoed:

Attachments (Terms of Use)


Links
System ID Private Priority Status Summary Last Updated
Red Hat Product Errata RHSA-2024:4633 0 None None None 2024-07-18 15:17:58 UTC
Red Hat Product Errata RHSA-2024:4997 0 None None None 2024-08-05 00:59:26 UTC
Red Hat Product Errata RHSA-2024:5192 0 None None None 2024-08-12 01:26:40 UTC
Red Hat Product Errata RHSA-2024:5690 0 None None None 2024-08-21 11:53:39 UTC
Red Hat Product Errata RHSA-2024:6153 0 None None None 2024-09-03 05:29:23 UTC
Red Hat Product Errata RHSA-2024:6568 0 None None None 2024-09-11 00:07:13 UTC
Red Hat Product Errata RHSA-2024:6569 0 None None None 2024-09-11 00:44:35 UTC
Red Hat Product Errata RHSA-2024:6576 0 None None None 2024-09-11 06:35:55 UTC

Internal Links: 2269530

Description Patrick Del Bello 2024-06-13 04:22:32 UTC 
A denial of service vulnerability was found in 389-ds-base ldap server. This issue may allow an authenticated user to cause a server crash or hang
while authenticating with an user having a malformed userPassword.
By default only the administrator may directly add hashed password that can trigger the issue. But if nsslapd-allow-hashed-passwords config parameter is turned on, any user can trigger the issue. 

The problem is triggered by adding a password to an user using the hashed format (with a hash value too long for the specified hash scheme)
Then later on when trying to authenticate on that user its triggers the buffer overflow

By default, only  administrators are allowed to add hashed passwords but there is a configuration parameter (nsslapd-allow-hashed-passwords) allowing any users to add hashed passwords and potentially trigger the DoS. 

This vulnerability affects versions: >= 1.3.7.2
Comment 1 Patrick Del Bello 2024-06-13 04:25:53 UTC 
Created 389-ds-base tracking bugs for this issue:

Affects: fedora-all [bug 2292109]
Comment 6 Jamie Chapman 2024-07-17 15:41:17 UTC 
Hi Patrick,

Can you create a clone of this ticket for a directory_server_12.4 z stream build.

Thank you
Comment 7 errata-xmlrpc 2024-07-18 15:17:56 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 9.2 Extended Update Support

Via RHSA-2024:4633 https://access.redhat.com/errata/RHSA-2024:4633
Comment 9 errata-xmlrpc 2024-08-05 00:59:25 UTC 
This issue has been addressed in the following products:

  Red Hat Directory Server 12.4 for RHEL 9

Via RHSA-2024:4997 https://access.redhat.com/errata/RHSA-2024:4997
Comment 10 errata-xmlrpc 2024-08-12 01:26:38 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 9

Via RHSA-2024:5192 https://access.redhat.com/errata/RHSA-2024:5192
Comment 11 errata-xmlrpc 2024-08-21 11:53:38 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8.8 Extended Update Support

Via RHSA-2024:5690 https://access.redhat.com/errata/RHSA-2024:5690
Comment 12 errata-xmlrpc 2024-09-03 05:29:22 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 7 Extended Lifecycle Support

Via RHSA-2024:6153 https://access.redhat.com/errata/RHSA-2024:6153
Comment 14 errata-xmlrpc 2024-09-11 00:07:11 UTC 
This issue has been addressed in the following products:

  Red Hat Directory Server 11.9 for RHEL 8

Via RHSA-2024:6568 https://access.redhat.com/errata/RHSA-2024:6568
Comment 15 errata-xmlrpc 2024-09-11 00:44:33 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8

Via RHSA-2024:6569 https://access.redhat.com/errata/RHSA-2024:6569
Comment 16 errata-xmlrpc 2024-09-11 06:35:53 UTC 
This issue has been addressed in the following products:

  Red Hat Directory Server 11.7 for RHEL 8

Via RHSA-2024:6576 https://access.redhat.com/errata/RHSA-2024:6576
Note You need to log in before you can comment on or make changes to this bug.