CVE-2017-15135 — Improper Authentication in HAT INC 389-ds-base

CWE-287 — Improper Authentication7 documents7 sources
Severity
8.1HIGHNVD
EPSS
0.3%
top 51.24%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
3
Port389 389-ds-baseFedoraproject 389 Directory ServerRED HAT INC 389-ds-base
Timeline
PublishedJan 24
Latest updateMay 14

Description

It was found that 389-ds-base since 1.3.6.1 up to and including 1.4.0.3 did not always handle internal hash comparison operations correctly during the authentication process. A remote, unauthenticated attacker could potentially use this flaw to bypass the authentication process under very rare and specific circumstances.

CVSS vector

CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:HExploitability: 2.2 | Impact: 5.9

Affected Packages3 packages

▶Debianport389/389-ds-base< 1.3.7.9-1+2
▶CVEListV5red_hat_inc/389-ds-basesince 1.3.6.1 up to and including 1.4.0.3
▶NVDfedoraproject/389_directory_server1.3.6.1 — 1.4.0.3

Patches

Patch: bugzilla.redhat.com ↗Patch: bugzilla.redhat.com ↗

🔴Vulnerability Details

3
GHSA
GHSA-frrc-qvjw-hwj9: It was found that 389-ds-base since 1↗2022-05-14
▶
CVEList
CVE-2017-15135: It was found that 389-ds-base since 1↗2018-01-24
▶
OSV
CVE-2017-15135: It was found that 389-ds-base since 1↗2018-01-24
▶

📋Vendor Advisories

2
Red Hat
389-ds-base: Authentication bypass due to lack of size check in slapi_ct_memcmp function in ch_malloc.c↗2018-01-22
▶
Debian
CVE-2017-15135: 389-ds-base - It was found that 389-ds-base since 1.3.6.1 up to and including 1.4.0.3 did not ...↗2017
▶

💬Community

1
Bugzilla
CVE-2017-15135 389-ds-base: Authentication bypass due to lack of size check in slapi_ct_memcmp function in ch_malloc.c↗2017-12-13
▶
CVE-2017-15135 — Improper Authentication | cvebase