CVE-2012-2746
published 2012-07-03CVE-2012-2746: 389 Directory Server before 1.2.11.6 (aka Red Hat Directory Server before 8.2.10-3), when the password of a LDAP user has been changed and audit logging is…
PriorityP414low2.1CVSS 2.0
AVNACHAuSCPINAN
EPSS
1.33%
68.0th percentile
389 Directory Server before 1.2.11.6 (aka Red Hat Directory Server before 8.2.10-3), when the password of a LDAP user has been changed and audit logging is enabled, saves the new password to the log in plain text, which allows remote authenticated users to read the password.
Affected
27 ranges· showing 25
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | 389-ds-base | — | — |
| fedoraproject | 389_directory_server | <= 1.2.11.5 | — |
| fedoraproject | 389_directory_server | — | — |
| fedoraproject | 389_directory_server | — | — |
| fedoraproject | 389_directory_server | — | — |
| fedoraproject | 389_directory_server | — | — |
| fedoraproject | 389_directory_server | — | — |
| fedoraproject | 389_directory_server | — | — |
| fedoraproject | 389_directory_server | — | — |
| fedoraproject | 389_directory_server | — | — |
| fedoraproject | 389_directory_server | — | — |
| fedoraproject | 389_directory_server | — | — |
| fedoraproject | 389_directory_server | — | — |
| fedoraproject | 389_directory_server | — | — |
| fedoraproject | 389_directory_server | — | — |
| fedoraproject | 389_directory_server | — | — |
| fedoraproject | 389_directory_server | — | — |
| fedoraproject | 389_directory_server | — | — |
| fedoraproject | 389_directory_server | — | — |
| fedoraproject | 389_directory_server | — | — |
| fedoraproject | 389_directory_server | — | — |
| fedoraproject | 389_directory_server | — | — |
| port389 | 389-ds-base | >= 0 < 1.3.2.16-0ubuntu1 | 1.3.2.16-0ubuntu1 |
| redhat | directory_server | <= 8.2 | — |
| redhat | directory_server | — | — |
CVSS provenance
nvdv2.02.1LOWAV:N/AC:H/Au:S/C:P/I:N/A:N
osv2.1LOW
vendor_debian2.1LOW
vendor_redhat2.1LOW
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Red Hat
rhds/389: plaintext password disclosure in audit log
vendor_redhat·2012-05-10·CVSS 2.1
CVE-2012-2746 [LOW] rhds/389: plaintext password disclosure in audit log
rhds/389: plaintext password disclosure in audit log
389 Directory Server before 1.2.11.6 (aka Red Hat Directory Server before 8.2.10-3), when the password of a LDAP user has been changed and audit logging is enabled, saves the new password to the log in plain text, which allows remote authenticated users to read the password.
Package: Directory Server (Red Hat Directory Server 9) - Affected
Debian
CVE-2012-2746: 389-ds-base - 389 Directory Server before 1.2.11.6 (aka Red Hat Directory Server before 8.2.10...
vendor_debian·2012·CVSS 2.1
CVE-2012-2746 [LOW] CVE-2012-2746: 389-ds-base - 389 Directory Server before 1.2.11.6 (aka Red Hat Directory Server before 8.2.10...
389 Directory Server before 1.2.11.6 (aka Red Hat Directory Server before 8.2.10-3), when the password of a LDAP user has been changed and audit logging is enabled, saves the new password to the log in plain text, which allows remote authenticated users to read the password.
Scope: local
bookworm: resolved
bullseye: resolved
sid: resolved
trixie: resolved
GHSA
GHSA-x3v3-65v7-r727: 389 Directory Server before 1
ghsa_unreviewed·2022-05-17
CVE-2012-2746 [LOW] GHSA-x3v3-65v7-r727: 389 Directory Server before 1
389 Directory Server before 1.2.11.6 (aka Red Hat Directory Server before 8.2.10-3), when the password of a LDAP user has been changed and audit logging is enabled, saves the new password to the log in plain text, which allows remote authenticated users to read the password.
OSV
CVE-2012-2746: 389 Directory Server before 1
osv·2012-07-03·CVSS 2.1
CVE-2012-2746 [LOW] CVE-2012-2746: 389 Directory Server before 1
389 Directory Server before 1.2.11.6 (aka Red Hat Directory Server before 8.2.10-3), when the password of a LDAP user has been changed and audit logging is enabled, saves the new password to the log in plain text, which allows remote authenticated users to read the password.
No detection rules found.
No public exploits indexed.
Bugzilla
CVE-2012-2678 CVE-2012-2746 389-ds-base various flaws [fedora-all]
bugzilla·2012-06-26·CVSS 1.2
CVE-2012-2678 [LOW] CVE-2012-2678 CVE-2012-2746 389-ds-base various flaws [fedora-all]
CVE-2012-2678 CVE-2012-2746 389-ds-base various flaws [fedora-all]
This is an automatically created tracking bug! It was created to ensure
that one or more security vulnerabilities are fixed in affected Fedora
versions.
For comments that are specific to the vulnerability please use bugs filed
against "Security Response" product referenced in the "Blocks" field.
For more information see:
http://fedoraproject.org/wiki/Security/TrackingBugs
When creating a Bodhi update request, please include this bug ID and the
bug IDs of this bug's parent bugs filed against the "Security Response"
product (the top-level CVE bugs). Please mention the CVE IDs being fixed
in the RPM changelog when available.
Bodhi update submission link:
https://admin.fedoraproject.org/updates/new/?type_=security&bugs=829
Bugzilla
CVE-2012-2678 CVE-2012-2746 389-ds-base various flaws [epel-5]
bugzilla·2012-06-26·CVSS 1.2
CVE-2012-2678 [LOW] CVE-2012-2678 CVE-2012-2746 389-ds-base various flaws [epel-5]
CVE-2012-2678 CVE-2012-2746 389-ds-base various flaws [epel-5]
This is an automatically created tracking bug! It was created to ensure
that one or more security vulnerabilities are fixed in affected Fedora
versions.
For comments that are specific to the vulnerability please use bugs filed
against "Security Response" product referenced in the "Blocks" field.
For more information see:
http://fedoraproject.org/wiki/Security/TrackingBugs
When creating a Bodhi update request, please include this bug ID and the
bug IDs of this bug's parent bugs filed against the "Security Response"
product (the top-level CVE bugs). Please mention the CVE IDs being fixed
in the RPM changelog when available.
Bodhi update submission link:
https://admin.fedoraproject.org/updates/new/?type_=security&bugs=829933
Bugzilla
CVE-2012-2746 rhds/389: plaintext password disclosure in audit log
bugzilla·2012-06-19·CVSS 2.1
CVE-2012-2746 [LOW] CVE-2012-2746 rhds/389: plaintext password disclosure in audit log
CVE-2012-2746 rhds/389: plaintext password disclosure in audit log
A flaw was found [1] in the way 389 Directory Server and Red Hat Directory Server handled logging to the audit log. When a user changed their password in the directory, the new password would be written to the audit log in plaintext.
Although the directory server administrator can configure the path and permissions of the audit log, by default it is mode 0600, owned by the directory server user, and is located in the directory server log directory (/var/log/dirsrv/slapd-[hostname]), which is mode 0770 and owned by the directory server user ("nobody", by default)
[1] https://fedorahosted.org/389/ticket/365
Discussion:
This issue has been addressed in following products:
Red Hat Enterprise Linux 6
Via RHSA-2012:0997 ht
Bugzilla
Audit log - clear text password in user changes
bugzilla·2012-06-08·CVSS 2.1
[LOW] Audit log - clear text password in user changes
Audit log - clear text password in user changes
This bug is created as a clone of upstream ticket:
https://fedorahosted.org/389/ticket/365
I have an 389 DS (version 1.2.10.4) with AD replication and I enabled
the audit log, but when I change a user password, shows the unhashed
password in the audit log file:
> time: 20120404113336
> dn: uid=alberto.viana,OU=G,OU=RJ,dc=my,dc=domain
> changetype: modify
> replace: userPassword
> userPassword: {SSHA}bqBSVbLJpqKCujEC2JC4ysaUUJuTsFe87AoPsQ==
> -
> replace: modifiersname
> modifiersname:
> uid=admin,ou=administrators,ou=topologymanagement,o=netscaperoo
> t
> -
> replace: modifytimestamp
> modifytimestamp: 20120404143336Z
> -
> replace: unhashed#user#password
> unhashed#user#password: maisumteste
> -
>
I Already know that is the expected behav
http://directory.fedoraproject.org/wiki/Release_Noteshttp://rhn.redhat.com/errata/RHSA-2012-0997.htmlhttp://rhn.redhat.com/errata/RHSA-2012-1041.htmlhttp://secunia.com/advisories/49734http://www.osvdb.org/83329http://www.securityfocus.com/bid/54153https://bugzilla.redhat.com/show_bug.cgi?id=833482https://exchange.xforce.ibmcloud.com/vulnerabilities/76595https://fedorahosted.org/389/ticket/365https://h20564.www2.hp.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c03772083https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A19241http://directory.fedoraproject.org/wiki/Release_Noteshttp://rhn.redhat.com/errata/RHSA-2012-0997.htmlhttp://rhn.redhat.com/errata/RHSA-2012-1041.htmlhttp://secunia.com/advisories/49734http://www.osvdb.org/83329http://www.securityfocus.com/bid/54153https://bugzilla.redhat.com/show_bug.cgi?id=833482https://exchange.xforce.ibmcloud.com/vulnerabilities/76595https://fedorahosted.org/389/ticket/365https://h20564.www2.hp.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c03772083https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A19241
2012-07-03
Published