389 Directory Server vulnerabilities

389 Directory Server before 1.3.3.10 allows attackers to bypass intended access restrictions and modify directory entries via a crafted ldapmodrdn call.

389 Directory Server in Red Hat Enterprise Linux 6 and 7 allows remote attackers to read the default Access Control Instructions.

The 389 Directory Server in Red Hat Enterprise Linux 6 and 7 allows remote attackers to infer the existence of RDN component objects.

In 389 Directory Server (formerly Fedora Directory Server) versions 1.3.4.x before 1.3.4.7, a vulnerability allows remote attackers to cause a denial of service through an abnormally closed connection, leading to an infinite loop and connection blocking.

389 Directory Server (formerly Fedora Directory Server) before version 1.3.3.12 does not enforce the nsSSL3Ciphers preference when creating an sslSocket, allowing remote attackers to use a disabled cipher.

The 389 Directory Server in Red Hat Enterprise Linux (Desktop, HPC Node, Server, Workstation) versions 6 and 7 allows remote attackers to obtain user passwords.

A flaw was found in 389 Directory Server. The CleanAllRUV and Abort CleanAllRUV replication-maintenance extended operations perform no authorization check, allowing an unauthenticated remote attacker to invoke them when nsslapd-allow-anonymous-access is enabled (the default), or any authenticated low-privilege user to invoke them otherwise. This allows removal of a replica ID from replication metadata, purging of changelog records, and interruption of administrator-initiated cleanup, which can leave replication inconsistent or unavailable.

389 Directory Server has a vulnerability in SASL PLAIN authentication. The server installs connection-level bind credentials before performing the account-lock check. If the account is locked, the bind is reported as failed, but the authenticated state on the connection is not reverted. A client with valid credentials for a locked account can continue to use the connection with that account's privileges.

A stack buffer overflow flaw was found in 389 Directory Server (389-ds-base) in the get_ruvelement_from_berval() function. A remote unauthenticated attacker can send a crafted StartNSDS50ReplicationRequest with a replica ID field containing more than 16 digit characters, causing a crash of the LDAP server.

A flaw was found in 389 Directory Server where an unauthenticated remote attacker can inject LDAP search filters into the CleanAllRUV operation. Because the query runs with elevated privileges, the attacker can extract sensitive server configuration metadata, including replication bind DNs and password storage scheme information.

In 389 Directory Server, the PBKDF2-SHA256 password verification function uses standard memcmp() instead of a constant-time comparison function. This allows a remote attacker to potentially infer partial hash information by measuring response times of LDAP bind requests.

A flaw in 389 Directory Server causes the attr_syntax_swap_ht() function to unconditionally free attribute syntax information nodes during schema reload, bypassing the refcount-based deferred deletion. If an administrator triggers schema reload while concurrent LDAP queries are active, worker threads may access freed memory, resulting in use-after-free or double-free and a denial of service (server crash).

A flaw was found in 389 Directory Server in the __aclp__normalize_acltxt() function of aclparse.c. A malformed ACI string can trigger heap-buffer-overflow writes and reads during ACI parsing due to insufficient validation of keyword length after whitespace stripping.

A heap buffer overflow vulnerability was found in 389 Directory Server. When serializing objectclass definitions, the oc_superior (SUP) field length is omitted from buffer size calculations in read_schema_dse() and schema_oc_to_string(), but the field is still written via strcat(). An attacker with Directory Manager privileges or a compromised replication supplier can trigger a server crash by creating objectclasses with long SUP values. This is an incomplete fix variant of CVE-2025-14905.

A stack buffer overflow was found in 389 Directory Server in the checkPrefix() function in pw.c. An attacker with Directory Manager privileges can store crafted credentials with an oversized algorithm ID, causing the LDAP server to crash. FORTIFY_SOURCE limits this to denial of service only.

Heap buffer overflow in 389 Directory Server. The create_masked_entry_string() function in auditlog.c copies a password mask into a precisely-sized buffer without checking space, causing overflow when logging a short cleartext password.

In 389 Directory Server, the PBKDF2-SHA256 password storage plugin does not enforce an upper bound on the iteration count extracted from stored password hashes. A privileged attacker who can modify a user's password hash can cause excessive CPU consumption during authentication, resulting in denial of service.

A flaw was found in 389 Directory Server in the SMD5 password storage plugin. When processing a crafted password hash shorter than 16 bytes, an unsigned integer underflow occurs when computing salt length, causing a buffer over-read and crashing the LDAP server during authentication.

In 389 Directory Server, the dereference control plugin does not check for allocation failure before using a BER structure. An unauthenticated remote attacker can crash the LDAP server when the system is under memory pressure.

389 Directory Server contains a vulnerability in the ldap_utf8prev() function that reads bytes before the start of a buffer without bounds checking, causing a heap buffer over-read in string filter parsing that may influence internal filter processing behavior.

In 389 Directory Server, the LDIF parser reads past the end of a heap buffer when processing attribute types with trailing semicolons during database import, causing an out-of-bounds read detectable under memory instrumentation.

389 Directory Server contains a type confusion vulnerability in the SSO token extended operation handler that causes partial stack address information to be disclosed in LDAP responses to authenticated users.

A flaw in the 389 Directory Server's Content Synchronization persistent search plugin causes unbounded memory growth when an authenticated client stops reading sync responses, enabling denial of service. Race conditions in plugin thread lifecycle can also cause crashes during connection teardown or shutdown.