SUSE update for 389-ds

Published: 2022-06-24 | Updated: 2022-08-18

Risk	Medium
Patch available	YES
Number of vulnerabilities	5
CVE-ID	CVE-2021-3652 CVE-2021-4091 CVE-2022-0918 CVE-2022-0996 CVE-2022-1949
CWE-ID	CWE-287 CWE-416 CWE-119 CWE-613 CWE-863
Exploitation vector	Network
Public exploit	Public exploit code for vulnerability #3 is available.
Vulnerable software Subscribe	SUSE Linux Enterprise Server for SAP Operating systems & Components / Operating system SUSE Linux Enterprise High Performance Computing Operating systems & Components / Operating system SUSE Enterprise Storage Operating systems & Components / Operating system SUSE CaaS Platform Operating systems & Components / Operating system SUSE Linux Enterprise Server Operating systems & Components / Operating system libsvrcore0-debuginfo Operating systems & Components / Operating system package or component libsvrcore0 Operating systems & Components / Operating system package or component lib389 Operating systems & Components / Operating system package or component 389-ds-snmp-debuginfo Operating systems & Components / Operating system package or component 389-ds-snmp Operating systems & Components / Operating system package or component 389-ds-devel Operating systems & Components / Operating system package or component 389-ds-debugsource Operating systems & Components / Operating system package or component 389-ds-debuginfo Operating systems & Components / Operating system package or component 389-ds Operating systems & Components / Operating system package or component
Vendor	SUSE

Security Bulletin

This security bulletin contains information about 5 vulnerabilities.

1) Improper Authentication

EUVDB-ID: #VU55334

Risk: Medium

CVSSv3.1: 4.2 [CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N/E:U/RL:O/RC:C]

CVE-ID: CVE-2021-3652

CWE-ID: CWE-287 - Improper Authentication

Exploit availability: No

Description

The vulnerability allows a remote attacker to bypass authentication process.

The vulnerability exists due to an error in the way the asterisk character is processed by the LDAP server when importing password hashes from /etc/shadow for disabled accounts. As a result of the flaw, if an LDAP admin imports such an account from a NIS or /etc/shadow database into Directory Server, any password will be valid for that account.

Mitigation

Update the affected package 389-ds to the latest version.

Vulnerable software versions

SUSE Linux Enterprise Server for SAP: 15-SP1

SUSE Linux Enterprise High Performance Computing: 15-SP1-ESPOS - 15-SP1-LTSS

SUSE Enterprise Storage: 6

SUSE CaaS Platform: 4.0

SUSE Linux Enterprise Server: 15-SP1-BCL - 15-SP1-LTSS

libsvrcore0-debuginfo: before 1.4.2.16~git68.efa843752-150100.7.34.1

libsvrcore0: before 1.4.2.16~git68.efa843752-150100.7.34.1

lib389: before 1.4.2.16~git68.efa843752-150100.7.34.1

389-ds-snmp-debuginfo: before 1.4.2.16~git68.efa843752-150100.7.34.1

389-ds-snmp: before 1.4.2.16~git68.efa843752-150100.7.34.1

389-ds-devel: before 1.4.2.16~git68.efa843752-150100.7.34.1

389-ds-debugsource: before 1.4.2.16~git68.efa843752-150100.7.34.1

389-ds-debuginfo: before 1.4.2.16~git68.efa843752-150100.7.34.1

389-ds: before 1.4.2.16~git68.efa843752-150100.7.34.1

External links

http://www.suse.com/support/update/announcement/2022/suse-su-20222163-1/

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

2) Use-after-free

EUVDB-ID: #VU60867

Risk: Medium

CVSSv3.1: 5 [CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2021-4091

CWE-ID: CWE-416 - Use After Free

Exploit availability: No

Description

The vulnerability allows a remote user to perform a denial of service (DoS) attack.

The vulnerability exists due to a use-after-free error when processing virtual attributes context in persistent searches. A remote user can send specially crafted search requests to the directory server, trigger a use-after-free error and crash the server.

Mitigation

Update the affected package 389-ds to the latest version.

Vulnerable software versions

SUSE Linux Enterprise Server for SAP: 15-SP1

SUSE Linux Enterprise High Performance Computing: 15-SP1-ESPOS - 15-SP1-LTSS

SUSE Enterprise Storage: 6

SUSE CaaS Platform: 4.0

SUSE Linux Enterprise Server: 15-SP1-BCL - 15-SP1-LTSS

libsvrcore0-debuginfo: before 1.4.2.16~git68.efa843752-150100.7.34.1

libsvrcore0: before 1.4.2.16~git68.efa843752-150100.7.34.1

lib389: before 1.4.2.16~git68.efa843752-150100.7.34.1

389-ds-snmp-debuginfo: before 1.4.2.16~git68.efa843752-150100.7.34.1

389-ds-snmp: before 1.4.2.16~git68.efa843752-150100.7.34.1

389-ds-devel: before 1.4.2.16~git68.efa843752-150100.7.34.1

389-ds-debugsource: before 1.4.2.16~git68.efa843752-150100.7.34.1

389-ds-debuginfo: before 1.4.2.16~git68.efa843752-150100.7.34.1

389-ds: before 1.4.2.16~git68.efa843752-150100.7.34.1

External links

http://www.suse.com/support/update/announcement/2022/suse-su-20222163-1/

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote authenticated user via the local network (LAN).

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

3) Buffer overflow

EUVDB-ID: #VU63128

Risk: Medium

CVSSv3.1: 5.9 [CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H/E:P/RL:O/RC:C]

CVE-ID: CVE-2022-0918

CWE-ID: CWE-119 - Memory corruption

Exploit availability: Yes

Description

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to a boundary error when handling network packets. A remote attacker can create a single TCP packet to the LDAP port, trigger a segmentation fault and crash the slapd daemon.

Mitigation

Update the affected package 389-ds to the latest version.

Vulnerable software versions

SUSE Linux Enterprise Server for SAP: 15-SP1

SUSE Linux Enterprise High Performance Computing: 15-SP1-ESPOS - 15-SP1-LTSS

SUSE Enterprise Storage: 6

SUSE CaaS Platform: 4.0

SUSE Linux Enterprise Server: 15-SP1-BCL - 15-SP1-LTSS

libsvrcore0-debuginfo: before 1.4.2.16~git68.efa843752-150100.7.34.1

libsvrcore0: before 1.4.2.16~git68.efa843752-150100.7.34.1

lib389: before 1.4.2.16~git68.efa843752-150100.7.34.1

389-ds-snmp-debuginfo: before 1.4.2.16~git68.efa843752-150100.7.34.1

389-ds-snmp: before 1.4.2.16~git68.efa843752-150100.7.34.1

389-ds-devel: before 1.4.2.16~git68.efa843752-150100.7.34.1

389-ds-debugsource: before 1.4.2.16~git68.efa843752-150100.7.34.1

389-ds-debuginfo: before 1.4.2.16~git68.efa843752-150100.7.34.1

389-ds: before 1.4.2.16~git68.efa843752-150100.7.34.1

External links

http://www.suse.com/support/update/announcement/2022/suse-su-20222163-1/

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability. However, proof of concept for this vulnerability is available.

4) Insufficient Session Expiration

EUVDB-ID: #VU64661

Risk: Medium

CVSSv3.1: 6.5 [CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C]

CVE-ID: CVE-2022-0996

CWE-ID: CWE-613 - Insufficient Session Expiration

Exploit availability: No

Description

The vulnerability allows a remote attacker to gain access to sensitive information.

The vulnerability exists due to insufficient session expiration issue that allows expired passwords to access the database to cause improper authentication. A remote non-authenticated attacker can obtain or guess session token and gain unauthorized access to session that belongs to another user.

Mitigation

Update the affected package 389-ds to the latest version.

Vulnerable software versions

SUSE Linux Enterprise Server for SAP: 15-SP1

SUSE Linux Enterprise High Performance Computing: 15-SP1-ESPOS - 15-SP1-LTSS

SUSE Enterprise Storage: 6

SUSE CaaS Platform: 4.0

SUSE Linux Enterprise Server: 15-SP1-BCL - 15-SP1-LTSS

libsvrcore0-debuginfo: before 1.4.2.16~git68.efa843752-150100.7.34.1

libsvrcore0: before 1.4.2.16~git68.efa843752-150100.7.34.1

lib389: before 1.4.2.16~git68.efa843752-150100.7.34.1

389-ds-snmp-debuginfo: before 1.4.2.16~git68.efa843752-150100.7.34.1

389-ds-snmp: before 1.4.2.16~git68.efa843752-150100.7.34.1

389-ds-devel: before 1.4.2.16~git68.efa843752-150100.7.34.1

389-ds-debugsource: before 1.4.2.16~git68.efa843752-150100.7.34.1

389-ds-debuginfo: before 1.4.2.16~git68.efa843752-150100.7.34.1

389-ds: before 1.4.2.16~git68.efa843752-150100.7.34.1

External links

http://www.suse.com/support/update/announcement/2022/suse-su-20222163-1/

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

5) Incorrect authorization

EUVDB-ID: #VU64440

Risk: Medium

CVSSv3.1: 5.2 [CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2022-1949

CWE-ID: CWE-863 - Incorrect Authorization

Exploit availability: No

Description

The vulnerability allows a remote attacker to perform a denial of service attack.

The vulnerability exists due to incorrect authorization in the 389-ds-base package where some LDAP queries can cause performance issues. A remote attacker can send a non-optimal search that causes serious performance issues within the directory server.

Mitigation

Update the affected package 389-ds to the latest version.

Vulnerable software versions

SUSE Linux Enterprise Server for SAP: 15-SP1

SUSE Linux Enterprise High Performance Computing: 15-SP1-ESPOS - 15-SP1-LTSS

SUSE Enterprise Storage: 6

SUSE CaaS Platform: 4.0

SUSE Linux Enterprise Server: 15-SP1-BCL - 15-SP1-LTSS

libsvrcore0-debuginfo: before 1.4.2.16~git68.efa843752-150100.7.34.1

libsvrcore0: before 1.4.2.16~git68.efa843752-150100.7.34.1

lib389: before 1.4.2.16~git68.efa843752-150100.7.34.1

389-ds-snmp-debuginfo: before 1.4.2.16~git68.efa843752-150100.7.34.1

389-ds-snmp: before 1.4.2.16~git68.efa843752-150100.7.34.1

389-ds-devel: before 1.4.2.16~git68.efa843752-150100.7.34.1

389-ds-debugsource: before 1.4.2.16~git68.efa843752-150100.7.34.1

389-ds-debuginfo: before 1.4.2.16~git68.efa843752-150100.7.34.1

389-ds: before 1.4.2.16~git68.efa843752-150100.7.34.1

External links

http://www.suse.com/support/update/announcement/2022/suse-su-20222163-1/

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.