It was found that 389-ds-base did not properly handle long search filters with characters needing escapes, possibly leading to buffer overflows. A remote, unauthenticated attacker could potentially use this flaw to make ns-slapd crash via a specially crafted LDAP request, thus resulting in denial of service.(CVE-2018-1089)

This update for 389-ds to version 1.4.0.26 fixes the following issues :

Security issues fixed :

CVE-2016-5416: Fixed an information disclosure where a anonymous user could read the default ACI (bsc#991201).

CVE-2018-1054: Fixed a denial of service via search filters in SetUnicodeStringFromUTF_8() (bsc#1083689).

CVE-2018-1089: Fixed a buffer overflow via large filter value (bsc#1092187).

CVE-2018-10871: Fixed an information disclosure in certain plugins leading to the disclosure of plaintext password to an privileged attackers (bsc#1099465).

CVE-2018-14638: Fixed a denial of service through a crash in delete_passwdPolicy () (bsc#1108674).

CVE-2018-14648: Fixed a denial of service caused by malformed values in search queries (bsc#1109609).

CVE-2018-10935: Fixed a denial of service related to ldapsearch with server side sort (bsc#1105606).

CVE-2019-3883: Fixed a denial of service caused by hanging LDAP requests over TLS (bsc#1132385).

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the version of the 389-ds-base packages installed, the EulerOS installation on the remote host is affected by the following vulnerability :

  - It was found that 389-ds-base did not properly handle     long search filters with characters needing escapes,     possibly leading to buffer overflows. A remote,     unauthenticated attacker could potentially use this     flaw to make ns-slapd crash via a specially crafted     LDAP request, thus resulting in denial of     service.(CVE-2018-1089)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

CVE-2015-1854 A flaw was found while doing authorization of modrdn operations. An unauthenticated attacker able to issue an ldapmodrdn call to the directory server could perform unauthorized modifications of entries in the directory server.

CVE-2017-15134 Improper handling of a search filter in slapi_filter_sprintf() in slapd/util.c can lead to remote server crash and denial of service.

CVE-2018-1054 When read access on <attribute_name> is enabled, a flaw in SetUnicodeStringFromUTF_8 function in collate.c, can lead to out-of-bounds memory operations. This might result in a server crash, caused by unauthorized users.

CVE-2018-1089 Any user (anonymous or authenticated) can crash ns-slapd with a crafted ldapsearch query with very long filter value.

CVE-2018-10850 Due to a race condition the server could crash in turbo mode (because of high traffic) or when a worker reads several requests in the read buffer (more_data). Thus an anonymous attacker could trigger a denial of service.

For Debian 8 'Jessie', these problems have been fixed in version 1.3.3.5-4+deb8u1.

We recommend that you upgrade your 389-ds-base packages.

NOTE: Tenable Network Security has extracted the preceding description block directly from the DLA security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - 389-ds-base before versions 1.4.0.9, 1.3.8.1, 1.3.6.15 did not properly handle long search filters with     characters needing escapes, possibly leading to buffer overflows. A remote, unauthenticated attacker could     potentially use this flaw to make ns-slapd crash via a specially crafted LDAP request, thus resulting in     denial of service. (CVE-2018-1089)

Note that Nessus relies on the presence of the package as reported by the vendor.

The remote NewStart CGSL host, running version CORE 5.04 / MAIN 5.04, has 389-ds-base packages installed that are affected by multiple vulnerabilities:

  - A race condition was found in the way 389-ds-base     handles persistent search, resulting in a crash if the     server is under load. An anonymous attacker could use     this flaw to trigger a denial of service.
    (CVE-2018-10850)

  - It was found that 389-ds-base did not properly handle     long search filters with characters needing escapes,     possibly leading to buffer overflows. A remote,     unauthenticated attacker could potentially use this flaw     to make ns-slapd crash via a specially crafted LDAP     request, thus resulting in denial of service.
    (CVE-2018-1089)

  - A vulnerability was discovered in 389-ds-base. The lock     controlling the error log was not correctly used when     re-opening the log file in log__error_emergency(). An     attacker could send a flood of modifications to a very     large DN, which would cause slapd to crash.
    (CVE-2018-14624)

  - A double-free of a password policy structure was found     in the way slapd was handling certain errors during     persistent search. A unauthenticated attacker could use     this flaw to crash Directory Server. (CVE-2018-14638)

  - A flaw was found in the 389 Directory Server that allows     users to cause a crash in the LDAP server using     ldapsearch with server side sort. (CVE-2018-10935)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

An update for 389-ds-base is now available for Red Hat Enterprise Linux 6.

Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

389 Directory Server is an LDAP version 3 (LDAPv3) compliant server.
The base packages include the Lightweight Directory Access Protocol (LDAP) server and command-line utilities for server administration.

Security Fix(es) :

* 389-ds-base: ns-slapd crash via large filter value in ldapsearch (CVE-2018-1089)

For more details about the security issue(s), including the impact, a CVSS score, and other related information, refer to the CVE page(s) listed in the References section.

Red Hat would like to thank Greg Kubok for reporting this issue.

The remote Redhat Enterprise Linux 6 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2018:1364 advisory.

    389 Directory Server is an LDAP version 3 (LDAPv3) compliant server. The base packages include the     Lightweight Directory Access Protocol (LDAP) server and command-line utilities for server administration.

    Security Fix(es):

    * 389-ds-base: ns-slapd crash via large filter value in ldapsearch (CVE-2018-1089)

    For more details about the security issue(s), including the impact, a CVSS score, and other related     information, refer to the CVE page(s) listed in the References section.

    Red Hat would like to thank Greg Kubok for reporting this issue.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2018:1380 advisory.

    389 Directory Server is an LDAP version 3 (LDAPv3) compliant server. The base packages include the     Lightweight Directory Access Protocol (LDAP) server and command-line utilities for server administration.

    Security Fix(es):

    * 389-ds-base: ns-slapd crash via large filter value in ldapsearch (CVE-2018-1089)

    For more details about the security issue(s), including the impact, a CVSS score, and other related     information, refer to the CVE page(s) listed in the References section.

    Red Hat would like to thank Greg Kubok for reporting this issue.

    Bug Fix(es):

    * Indexing tasks in Directory Server contain the nsTaskStatus attribute to monitor whether the task is     completed and the database is ready to receive updates. Before this update, the server set the value that     indexing had completed before the database was ready to receive updates. Applications which monitor     nsTaskStatus could start sending updates as soon as indexing completed, but before the database was ready.
    As a consequence, the server rejected updates with an UNWILLING_TO_PERFORM error. The problem has been     fixed. As a result, the nsTaskStatus attribute now shows that indexing is completed after the database is     ready to receive updates. (BZ#1553605)

    * Previously, Directory Server did not remember when the first operation, bind, or a connection was     started. As a consequence, the server applied in certain situations anonymous resource limits to an     authenticated client. With this update, Directory Server properly marks authenticated client connections.
    As a result, it applies the correct resource limits, and authenticated clients no longer get randomly     restricted by anonymous resource limits. (BZ#1554720)

    * When debug replication logging is enabled, Directory Server incorrectly logged an error that updating     the replica update vector (RUV) failed when in fact the update succeeded. The problem has been fixed, and     the server no longer logs an error if updating the RUV succeeds. (BZ#1559464)

    * This update adds the -W option to the ds-replcheck utility. With this option, ds-replcheck asks for the     password, similar to OpenLDAP utilities. As a result, the password is not stored in the shell's history     file when the -W option is used. (BZ#1559760)

    * If an administrator moves a group in Directory Server from one subtree to another, the memberOf plug-in     deletes the memberOf attribute with the old value and adds a new memberOf attribute with the new group's     distinguished name (DN) in affected user entries. Previously, if the old subtree was not within the scope     of the memberOf plug-in, deleting the old memberOf attribute failed because the values did not exist. As a     consequence, the plug-in did not add the new memberOf value, and the user entry contained an incorrect     memberOf value. With this update, the plug-in now checks the return code when deleting the old value. If     the return code is no such value, the plug-in only adds the new memberOf value. As a result, the     memberOf attribute information is correct. (BZ#1559764)

    * In a Directory Server replication topology, updates are managed by using Change Sequence Numbers (CSN)     based on time stamps. New CSNs must be higher than the highest CSN present in the relative update vector     (RUV). In case the server generates a new CSN in the same second as the most recent CSN, the sequence     number is increased to ensure that it is higher. However, if the most recent CSN and the new CSN were     identical, the sequence number was not increased. In this situation, the new CSN was, except the replica     ID, identical to the most recent one. As a consequence, a new update in the directory appeared in certain     situations older than the most recent update. With this update, Directory Server increases the CSN if the     sequence number is lower or equal to the most recent one. As a result, new updates are no longer     considered older than the most recent data. (BZ#1563079)

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

According to the versions of the 389-ds-base packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

  - It was found that 389-ds-base did not properly handle     long search filters with characters needing escapes,     possibly leading to buffer overflows. A remote,     unauthenticated attacker could potentially use this     flaw to make ns-slapd crash via a specially crafted     LDAP request, thus resulting in denial of     service.(CVE-2018-1089)

  - It was found that the uniqueness_entry_to_config()     function, used by the 'attribute uniqueness' plugin of     389 Directory Server, did not properly NULL terminate     an array used in some configuration. An authenticated,     or possibly unauthenticated, attacker could use this     flaw to force an out-of-bound heap memory read,     possibly triggering a crash of the LDAP     service.(CVE-2017-2591)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote Oracle Linux 7 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2018-1380 advisory.

    - Resolves: Bug 1559818 - EMBARGOED CVE-2018-1089 389-ds-base: ns-slapd crash via large filter value in     ldapsearch

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

An update for 389-ds-base is now available for Red Hat Enterprise Linux 7.

Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

389 Directory Server is an LDAP version 3 (LDAPv3) compliant server.
The base packages include the Lightweight Directory Access Protocol (LDAP) server and command-line utilities for server administration.

Security Fix(es) :

* 389-ds-base: ns-slapd crash via large filter value in ldapsearch (CVE-2018-1089)

For more details about the security issue(s), including the impact, a CVSS score, and other related information, refer to the CVE page(s) listed in the References section.

Red Hat would like to thank Greg Kubok for reporting this issue.

Bug Fix(es) :

* Indexing tasks in Directory Server contain the nsTaskStatus attribute to monitor whether the task is completed and the database is ready to receive updates. Before this update, the server set the value that indexing had completed before the database was ready to receive updates. Applications which monitor nsTaskStatus could start sending updates as soon as indexing completed, but before the database was ready. As a consequence, the server rejected updates with an UNWILLING_TO_PERFORM error. The problem has been fixed. As a result, the nsTaskStatus attribute now shows that indexing is completed after the database is ready to receive updates. (BZ#1553605)

* Previously, Directory Server did not remember when the first operation, bind, or a connection was started. As a consequence, the server applied in certain situations anonymous resource limits to an authenticated client. With this update, Directory Server properly marks authenticated client connections. As a result, it applies the correct resource limits, and authenticated clients no longer get randomly restricted by anonymous resource limits. (BZ#1554720)

* When debug replication logging is enabled, Directory Server incorrectly logged an error that updating the replica update vector (RUV) failed when in fact the update succeeded. The problem has been fixed, and the server no longer logs an error if updating the RUV succeeds. (BZ#1559464)

* This update adds the -W option to the ds-replcheck utility. With this option, ds-replcheck asks for the password, similar to OpenLDAP utilities. As a result, the password is not stored in the shell's history file when the -W option is used. (BZ#1559760)

* If an administrator moves a group in Directory Server from one subtree to another, the memberOf plug-in deletes the memberOf attribute with the old value and adds a new memberOf attribute with the new group's distinguished name (DN) in affected user entries.
Previously, if the old subtree was not within the scope of the memberOf plug-in, deleting the old memberOf attribute failed because the values did not exist. As a consequence, the plug-in did not add the new memberOf value, and the user entry contained an incorrect memberOf value. With this update, the plug-in now checks the return code when deleting the old value. If the return code is 'no such value', the plug-in only adds the new memberOf value. As a result, the memberOf attribute information is correct. (BZ#1559764)

* In a Directory Server replication topology, updates are managed by using Change Sequence Numbers (CSN) based on time stamps. New CSNs must be higher than the highest CSN present in the relative update vector (RUV). In case the server generates a new CSN in the same second as the most recent CSN, the sequence number is increased to ensure that it is higher. However, if the most recent CSN and the new CSN were identical, the sequence number was not increased. In this situation, the new CSN was, except the replica ID, identical to the most recent one. As a consequence, a new update in the directory appeared in certain situations older than the most recent update. With this update, Directory Server increases the CSN if the sequence number is lower or equal to the most recent one. As a result, new updates are no longer considered older than the most recent data. (BZ#1563079)

The remote Oracle Linux 6 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2018-1364 advisory.

    [1.2.11.15-95]
    - Bump version to 1.2.11-15-95
    - Resolves: Bug 1562152 - EMBARGOED CVE-2018-1089 389-ds-base: ns-slapd crash via large filter value in     ldapsearch

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote MiracleLinux 4 host has packages installed that are affected by a vulnerability as referenced in the AXSA:2018-3037:03 advisory.

    * 389-ds-base: ns-slapd crash via large filter value in ldapsearch (CVE-2018-1089)

Tenable has extracted the preceding description block directly from the MiracleLinux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote MiracleLinux 7 host has packages installed that are affected by a vulnerability as referenced in the AXSA:2018-3062:05 advisory.

    * 389-ds-base: ns-slapd crash via large filter value in ldapsearch (CVE-2018-1089)

Tenable has extracted the preceding description block directly from the MiracleLinux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

ID	名称	产品	系列	发布时间	最近更新时间	严重程度
110459	Amazon Linux AMI : 389-ds-base (ALAS-2018-1036)	Nessus	Amazon Linux Local Security Checks	2018/6/12	2024/9/24	high
128021	SUSE SLED15 / SLES15 Security Update : 389-ds (SUSE-SU-2019:2155-1)	Nessus	SuSE Local Security Checks	2019/8/20	2021/1/13	high
110453	Amazon Linux 2 : 389-ds-base (ALAS-2018-1036)	Nessus	Amazon Linux Local Security Checks	2018/6/12	2024/9/24	high
110855	EulerOS 2.0 SP3 : 389-ds-base (EulerOS-SA-2018-1191)	Nessus	Huawei Local Security Checks	2018/7/3	2024/9/9	high
111086	Debian DLA-1428-1 : 389-ds-base security update	Nessus	Debian Local Security Checks	2018/7/16	2024/9/4	high
256370	Linux Distros Unpatched Vulnerability : CVE-2018-1089	Nessus	Misc.	2025/8/27	2026/7/6	high
127210	NewStart CGSL CORE 5.04 / MAIN 5.04 : 389-ds-base Multiple Vulnerabilities (NS-SA-2019-0038)	Nessus	NewStart CGSL Local Security Checks	2019/8/12	2024/5/8	high
109656	CentOS 6 : 389-ds-base (CESA-2018:1364)	Nessus	CentOS Local Security Checks	2018/5/10	2024/10/11	high
109669	RHEL 6 : 389-ds-base (RHSA-2018:1364)	Nessus	Red Hat Local Security Checks	2018/5/10	2024/11/5	high
109832	RHEL 7 : 389-ds-base (RHSA-2018:1380)	Nessus	Red Hat Local Security Checks	2018/5/16	2025/4/15	high
110854	EulerOS 2.0 SP2 : 389-ds-base (EulerOS-SA-2018-1190)	Nessus	Huawei Local Security Checks	2018/7/3	2024/9/9	high
109807	Oracle Linux 7 : 389-ds-base (ELSA-2018-1380)	Nessus	Oracle Linux Local Security Checks	2018/5/15	2024/10/23	high
110246	CentOS 7 : 389-ds-base (CESA-2018:1380)	Nessus	CentOS Local Security Checks	2018/5/31	2024/9/30	high
109666	Oracle Linux 6 : 389-ds-base (ELSA-2018-1364)	Nessus	Oracle Linux Local Security Checks	2018/5/10	2024/10/22	high
291660	MiracleLinux 4 : 389-ds-base-1.2.11.15-95.AXS4 (AXSA:2018-3037:03)	Nessus	Miracle Linux Local Security Checks	2026/1/19	2026/1/19	high
294047	MiracleLinux 7 : 389-ds-base-1.3.7.5-21.el7 (AXSA:2018-3062:05)	Nessus	Miracle Linux Local Security Checks	2026/1/20	2026/1/20	high

检测

插件搜索

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high