CVE-2016-5405

CWE-199CWE-3858 documents7 sources
Severity
9.8CRITICAL
EPSS
0.6%
top 30.75%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
4
Redhat Enterprise Linux DesktopRedhat Enterprise Linux HPC NodeRedhat Enterprise Linux Server+1 more
Timeline
PublishedJun 8
Latest updateMay 17

Description

389 Directory Server in Red Hat Enterprise Linux Desktop 6 through 7, Red Hat Enterprise Linux HPC Node 6 through 7, Red Hat Enterprise Linux Server 6 through 7, and Red Hat Enterprise Linux Workstation 6 through 7 allows remote attackers to obtain user passwords.

CVSS vector

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HExploitability: 3.9 | Impact: 5.9

Affected Packages5 packages

▶Debian389-ds-base< 1.3.5.15-1+2

🔴Vulnerability Details

3
GHSA
GHSA-3mg8-mw7w-wg96: 389 Directory Server in Red Hat Enterprise Linux Desktop 6 through 7, Red Hat Enterprise Linux HPC Node 6 through 7, Red Hat Enterprise Linux Server 6↗2022-05-17
▶
CVEList
CVE-2016-5405: 389 Directory Server in Red Hat Enterprise Linux Desktop 6 through 7, Red Hat Enterprise Linux HPC Node 6 through 7, Red Hat Enterprise Linux Server 6↗2017-06-08
▶
OSV
CVE-2016-5405: 389 Directory Server in Red Hat Enterprise Linux Desktop 6 through 7, Red Hat Enterprise Linux HPC Node 6 through 7, Red Hat Enterprise Linux Server 6↗2017-06-08
▶

📋Vendor Advisories

2
Red Hat
389-ds-base: Password verification vulnerable to timing attack↗2016-10-26
▶
Debian
CVE-2016-5405: 389-ds-base - 389 Directory Server in Red Hat Enterprise Linux Desktop 6 through 7, Red Hat En...↗2016
▶

💬Community

2
Bugzilla
CVE-2017-15135 389-ds-base: Authentication bypass due to lack of size check in slapi_ct_memcmp function in ch_malloc.c↗2017-12-13
▶
Bugzilla
CVE-2016-5405 389-ds-base: Password verification vulnerable to timing attack↗2016-07-21
▶