The remote MiracleLinux 7 host has packages installed that are affected by a vulnerability as referenced in the AXSA:2017-1608:03 advisory.

    389 Directory Server is an LDAPv3 compliant server.  The base package includes     the LDAP server and command line utilities for server administration.
    Security issues fixed with this release:
    CVE-2017-2668
    ** RESERVED **     This candidate has been reserved by an organization or individual that     will use it when announcing a new security problem.  When the     candidate has been publicized, the details for this candidate will be     provided.
    Fixed bugs:
    * Previously, when adding a filtered role definition that uses the nsrole virtual attribute in the     filter, Directory Server terminated unexpectedly. A patch has been applied, and now the roles plug-in     ignores all virtual attributes. As a result, an error message is logged when an invalid filter is used.
    Additionally, the role is deactivated and Directory Server no longer fails.
    * In a replication topology, Directory Server incorrectly calculated the size of string format entries     when a lot of entries were deleted. The calculated size of entries was smaller than the actual required     size. Consequently, Directory Server allocated insufficient memory and terminated unexpectedly when the     data was written to it. With this update, the size of string format entries is now calculated correctly in     the described situation and Directory Server no longer terminates unexpectedly.

Tenable has extracted the preceding description block directly from the MiracleLinux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote MiracleLinux 4 host has packages installed that are affected by a vulnerability as referenced in the AXSA:2017-1583:03 advisory.

    389 Directory Server is an LDAPv3 compliant server.  The base package includes     the LDAP server and command line utilities for server administration.
    Security issues fixed with this release:
    CVE-2017-2668
    ** RESERVED **     This candidate has been reserved by an organization or individual that     will use it when announcing a new security problem.  When the     candidate has been publicized, the details for this candidate will be     provided.
    Fixed bugs:
    * Previously, the deref plug-in failed to dereference attributes that use distinguished name (DN)     syntax, such as uniqueMember. With this patch, the deref plug-in can dereference such attributes and     additionally Name and Optional UID syntax. As a result, the deref plug-in now supports any syntax.

Tenable has extracted the preceding description block directly from the MiracleLinux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

An update for 389-ds-base is now available for Red Hat Enterprise Linux 6.

Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

389 Directory Server is an LDAP version 3 (LDAPv3) compliant server.
The base packages include the Lightweight Directory Access Protocol (LDAP) server and command-line utilities for server administration.

Security Fix(es) :

* An invalid pointer dereference flaw was found in the way 389-ds-base handled LDAP bind requests. A remote unauthenticated attacker could use this flaw to make ns-slapd crash via a specially crafted LDAP bind request, resulting in denial of service. (CVE-2017-2668)

Red Hat would like to thank Joachim Jabs (F24) for reporting this issue.

Bug Fix(es) :

* Previously, the 'deref' plug-in failed to dereference attributes that use distinguished name (DN) syntax, such as 'uniqueMember'. With this patch, the 'deref' plug-in can dereference such attributes and additionally 'Name and Optional UID' syntax. As a result, the 'deref' plug-in now supports any syntax. (BZ#1435365)

Note that Tenable Network Security has attempted to extract the preceding description block directly from the corresponding Red Hat security advisory. Virtuozzo provides no description for VZLSA advisories. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

An update for 389-ds-base is now available for Red Hat Enterprise Linux 6.

Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

389 Directory Server is an LDAP version 3 (LDAPv3) compliant server.
The base packages include the Lightweight Directory Access Protocol (LDAP) server and command-line utilities for server administration.

Security Fix(es) :

* An invalid pointer dereference flaw was found in the way 389-ds-base handled LDAP bind requests. A remote unauthenticated attacker could use this flaw to make ns-slapd crash via a specially crafted LDAP bind request, resulting in denial of service. (CVE-2017-2668)

Red Hat would like to thank Joachim Jabs (F24) for reporting this issue.

Bug Fix(es) :

* Previously, the 'deref' plug-in failed to dereference attributes that use distinguished name (DN) syntax, such as 'uniqueMember'. With this patch, the 'deref' plug-in can dereference such attributes and additionally 'Name and Optional UID' syntax. As a result, the 'deref' plug-in now supports any syntax. (BZ#1435365)

The remote Oracle Linux 7 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2017-0920 advisory.

    - Resolves: bug 1437005 - CVE-2017-2668 389-ds-base: Remote crash via crafted LDAP messages

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

Remote crash via crafted LDAP messages :

An invalid pointer dereference flaw was found in the way 389-ds-base handled LDAP bind requests. A remote unauthenticated attacker could use this flaw to make ns-slapd crash via a specially crafted LDAP bind request, resulting in denial of service. (CVE-2017-2668)

ID	名称	产品	系列	发布时间	最近更新时间	严重程度
289443	MiracleLinux 7 : 389-ds-base-1.3.5.10-20.el7 (AXSA:2017-1608:03)	Nessus	Miracle Linux Local Security Checks	2026/1/16	2026/1/16	medium
289708	MiracleLinux 4 : 389-ds-base-1.2.11.15-91.AXS4 (AXSA:2017-1583:03)	Nessus	Miracle Linux Local Security Checks	2026/1/16	2026/1/16	medium
101444	Virtuozzo 6 : 389-ds-base / 389-ds-base-devel / 389-ds-base-libs (VZLSA-2017-0893)	Nessus	Virtuozzo Local Security Checks	2017/7/13	2025/12/11	medium
99317	CentOS 6 : 389-ds-base (CESA-2017:0893)	Nessus	CentOS Local Security Checks	2017/4/13	2021/1/4	medium
99332	Oracle Linux 7 : 389-ds-base (ELSA-2017-0920)	Nessus	Oracle Linux Local Security Checks	2017/4/13	2024/10/22	medium
99712	Amazon Linux AMI : 389-ds-base (ALAS-2017-824)	Nessus	Amazon Linux Local Security Checks	2017/4/28	2025/12/23	medium

检测

插件搜索

medium

medium

medium

medium

medium

medium