CVE-2018-10935
published 2018-09-11CVE-2018-10935: A flaw was found in the 389 Directory Server that allows users to cause a crash in the LDAP server using ldapsearch with server side sort.
PriorityP431medium6.5CVSS 3.1
AVNACLPRLUINSUCNINAH
EPSS
1.85%
76.7th percentile
A flaw was found in the 389 Directory Server that allows users to cause a crash in the LDAP server using ldapsearch with server side sort.
Affected
7 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | 389-ds-base | < 389-ds-base 1.4.0.15-1 (bookworm) | 389-ds-base 1.4.0.15-1 (bookworm) |
| port389 | 389-ds-base | >= 0 < 1.4.0.15-1 | 1.4.0.15-1 |
| port389 | 389-ds-base | >= 0 < 1.4.0.15-1 | 1.4.0.15-1 |
| port389 | 389-ds-base | >= 0 < 1.4.0.15-1 | 1.4.0.15-1 |
| red_hat | 389-ds-base | — | — |
| redhat | 389_directory_server | >= 1.3.0.0 < 1.3.8.7 | 1.3.8.7 |
| redhat | 389_directory_server | >= 1.4.0.0 < 1.4.0.14 | 1.4.0.14 |
CVSS provenance
nvdv3.16.5MEDIUMCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
nvdv3.06.5MEDIUMCVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
nvdv2.04.0MEDIUMAV:N/AC:L/Au:S/C:N/I:N/A:P
osv6.5MEDIUM
vendor_debian6.5MEDIUM
vendor_redhat6.5MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
GHSA-f8xp-r7x3-274c: A flaw was found in the 389 Directory Server that allows users to cause a crash in the LDAP server using ldapsearch with server side sort
ghsa_unreviewed·2022-05-13
CVE-2018-10935 [MEDIUM] CWE-20 GHSA-f8xp-r7x3-274c: A flaw was found in the 389 Directory Server that allows users to cause a crash in the LDAP server using ldapsearch with server side sort
A flaw was found in the 389 Directory Server that allows users to cause a crash in the LDAP server using ldapsearch with server side sort.
OSV
CVE-2018-10935: A flaw was found in the 389 Directory Server that allows users to cause a crash in the LDAP server using ldapsearch with server side sort
osv·2018-09-11·CVSS 6.5
CVE-2018-10935 [MEDIUM] CVE-2018-10935: A flaw was found in the 389 Directory Server that allows users to cause a crash in the LDAP server using ldapsearch with server side sort
A flaw was found in the 389 Directory Server that allows users to cause a crash in the LDAP server using ldapsearch with server side sort.
Red Hat
389-ds-base: ldapsearch with server side sort allows users to cause a crash
vendor_redhat·2018-07-22·CVSS 6.5
CVE-2018-10935 [MEDIUM] CWE-400 389-ds-base: ldapsearch with server side sort allows users to cause a crash
389-ds-base: ldapsearch with server side sort allows users to cause a crash
A flaw was found in the 389 Directory Server that allows users to cause a crash in the LDAP server using ldapsearch with server side sort.
Package: 389-ds-base (Red Hat Enterprise Linux 6) - Not affected
Package: 389-ds-base (Red Hat Enterprise Linux 8) - Not affected
Debian
CVE-2018-10935: 389-ds-base - A flaw was found in the 389 Directory Server that allows users to cause a crash ...
vendor_debian·2018·CVSS 6.5
CVE-2018-10935 [MEDIUM] CVE-2018-10935: 389-ds-base - A flaw was found in the 389 Directory Server that allows users to cause a crash ...
A flaw was found in the 389 Directory Server that allows users to cause a crash in the LDAP server using ldapsearch with server side sort.
Scope: local
bookworm: resolved (fixed in 1.4.0.15-1)
bullseye: resolved (fixed in 1.4.0.15-1)
sid: resolved (fixed in 1.4.0.15-1)
trixie: resolved (fixed in 1.4.0.15-1)
No detection rules found.
No public exploits indexed.
Bugzilla
CVE-2018-10935 389-ds-base: ldapsearch with server side sort crashes the ldap server [rhel-7.5.z]
bugzilla·2018-08-10·CVSS 6.5
CVE-2018-10935 [MEDIUM] CVE-2018-10935 389-ds-base: ldapsearch with server side sort crashes the ldap server [rhel-7.5.z]
CVE-2018-10935 389-ds-base: ldapsearch with server side sort crashes the ldap server [rhel-7.5.z]
This bug has been copied from bug #1607078 and has been proposed to be backported to 7.5 z-stream (EUS).
Discussion:
Build tested: 389-ds-base-1.3.7.5-26.el7_5.x86_64
Search with server side sort no longer crashes the server, but it doesn't return sorted results per matching rule (bz1615163):
[root@server ds]# ldapsearch -xLLL -D cn=Directory\ Manager -w Secret123 -b cn=users,cn=accounts,dc=ipa,dc=test -E sss=uid:2.5.13.3 "(uid=tuser*)" uid | grep uid:
uid: tuser2
uid: tuser3
uid: tuser
[root@server ds]# ldapsearch -xLLL -D cn=Directory\ Manager -w Secret123 -b cn=users,cn=accounts,dc=ipa,dc=test -E sss=-uid:2.5.13.3 "(uid=tuser*)" uid | grep uid:
uid: tuser2
uid: tuser3
uid: tuser
Mark
Bugzilla
CVE-2018-10935 389-ds-base: ldapsearch with server side sort allows users to cause a crash [fedora-all]
bugzilla·2018-08-08·CVSS 6.5
CVE-2018-10935 [MEDIUM] CVE-2018-10935 389-ds-base: ldapsearch with server side sort allows users to cause a crash [fedora-all]
CVE-2018-10935 389-ds-base: ldapsearch with server side sort allows users to cause a crash [fedora-all]
This is an automatically created tracking bug! It was created to ensure
that one or more security vulnerabilities are fixed in affected versions
of fedora-all.
For comments that are specific to the vulnerability please use bugs filed
against the "Security Response" product referenced in the "Blocks" field.
For more information see:
http://fedoraproject.org/wiki/Security/TrackingBugs
When submitting as an update, use the fedpkg template provided in the next
comment(s). This will include the bug IDs of this tracking bug as well as
the relevant top-level CVE bugs.
Please also mention the CVE IDs being fixed in the RPM changelog and the
fedpkg commit message.
NOTE: this issue affects m
Bugzilla
CVE-2018-10935 389-ds-base: ldapsearch with server side sort allows users to cause a crash
bugzilla·2018-08-08·CVSS 6.5
CVE-2018-10935 [MEDIUM] CVE-2018-10935 389-ds-base: ldapsearch with server side sort allows users to cause a crash
CVE-2018-10935 389-ds-base: ldapsearch with server side sort allows users to cause a crash
389 Directory Server has a flaw that allows users to cause a crash in the LDAP server using ldapsearch with server side sort.
Product Bug:
https://bugzilla.redhat.com/show_bug.cgi?id=1607078
Discussion:
Created 389-ds-base tracking bugs for this issue:
Affects: fedora-all [bug 1613607]
---
Upstream bug report:
https://pagure.io/389-ds-base/issue/49890
Upstream commit:
https://pagure.io/fork/mreynolds/389-ds-base/c/c989e18f7a3da060b16d39919b920b6b2a19a0ac
The fix was included in upstream versions 1.3.8.7 and 1.4.0.14:
http://www.port389.org/docs/389ds/releases/release-1-3-8-7.html
http://www.port389.org/docs/389ds/releases/release-1-4-0-14.html
---
This issue has been addressed in the
Bugzilla
CVE-2018-10935 389-ds-base: ldapsearch with server side sort crashes the ldap server [rhel-7.6]
bugzilla·2018-07-21·CVSS 6.5
CVE-2018-10935 [MEDIUM] CVE-2018-10935 389-ds-base: ldapsearch with server side sort crashes the ldap server [rhel-7.6]
CVE-2018-10935 389-ds-base: ldapsearch with server side sort crashes the ldap server [rhel-7.6]
Description of problem:
Any authenticated user doing a search using ldapsearch with extended controls for
server side sorting is bringing down the ldap server itself.
Version-Release number of selected component (if applicable):
389-ds-base-1.3.7.5-18.el7.x86_64.rpm
How reproducible:
- Always reproduciable
Steps to Reproduce:
- Just install the rpm with some sample data
- Run the below ldapsearch
ldapsearch -D"cn=Directory Manager" -W -E sss=uid:2.5.13.3
Actual results:
# ldapsearch -D"cn=Directory Manager" -W -E sss=uid:2.5.13.3 > /dev/null
Enter LDAP Password:
ldap_result: Can't contact LDAP server (-1)
#
- System logs show the server is no longer responding
Jul 21 14:33:37 ipa-lab-vm-0
http://lists.opensuse.org/opensuse-security-announce/2019-05/msg00033.htmlhttps://access.redhat.com/errata/RHSA-2018:2757https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-10935https://lists.debian.org/debian-lts-announce/2018/08/msg00032.htmlhttp://lists.opensuse.org/opensuse-security-announce/2019-05/msg00033.htmlhttps://access.redhat.com/errata/RHSA-2018:2757https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-10935https://lists.debian.org/debian-lts-announce/2018/08/msg00032.html
2018-09-11
Published