Vulnerabilities > CVE-2017-2591 - Out-of-bounds Read vulnerability in multiple products

047910
CVSS 7.5 - HIGH
Attack vector
NETWORK
Attack complexity
LOW
Privileges required
NONE
Confidentiality impact
NONE
Integrity impact
NONE
Availability impact
HIGH
network
low complexity
fedoraproject
redhat
CWE-125
nessus

Summary

389-ds-base before version 1.3.6 is vulnerable to an improperly NULL terminated array in the uniqueness_entry_to_config() function in the "attribute uniqueness" plugin of 389 Directory Server. An authenticated, or possibly unauthenticated, attacker could use this flaw to force an out-of-bound heap memory read, possibly triggering a crash of the LDAP service.

Vulnerable Configurations

Part Description Count
Application
Fedoraproject
134
OS
Redhat
1

Common Weakness Enumeration (CWE)

Common Attack Pattern Enumeration and Classification (CAPEC)

  • Overread Buffers
    An adversary attacks a target by providing input that causes an application to read beyond the boundary of a defined buffer. This typically occurs when a value influencing where to start or stop reading is set to reflect positions outside of the valid memory location of the buffer. This type of attack may result in exposure of sensitive information, a system crash, or arbitrary code execution.

Nessus

  • NASL familySuSE Local Security Checks
    NASL idOPENSUSE-2017-1396.NASL
    descriptionThis update for 389-ds fixes the following issues : - CVE-2017-7551: 389-ds-base: Password brute-force possible for locked account due to different return codes (bsc#1051997) - CVE-2016-4992: 389-ds: Information disclosure via repeated use of LDAP ADD operation (bsc#997256) - CVE-2016-5405: 389-ds: Password verification vulnerable to timing attack (bsc#1007004) - CVE-2017-2591: 389-ds-base: Heap buffer overflow in uiduniq.c (bsc#1020670) - CVE-2017-2668 389-ds Remote crash via crafted LDAP messages (bsc#1069067) - CVE-2016-0741: 389-ds: worker threads do not detect abnormally closed connections causing DoS (bsc#1069074)
    last seen2020-06-05
    modified2017-12-19
    plugin id105366
    published2017-12-19
    reporterThis script is Copyright (C) 2017-2020 Tenable Network Security, Inc.
    sourcehttps://www.tenable.com/plugins/nessus/105366
    titleopenSUSE Security Update : 389-ds (openSUSE-2017-1396)
    code
    #%NASL_MIN_LEVEL 80502
    #
    # (C) Tenable Network Security, Inc.
    #
    # The descriptive text and package checks in this plugin were
    # extracted from openSUSE Security Update openSUSE-2017-1396.
    #
    # The text description of this plugin is (C) SUSE LLC.
    #
    
    include("compat.inc");
    
    if (description)
    {
      script_id(105366);
      script_version("3.3");
      script_set_attribute(attribute:"plugin_modification_date", value:"2020/06/04");
    
      script_cve_id("CVE-2016-0741", "CVE-2016-4992", "CVE-2016-5405", "CVE-2017-2591", "CVE-2017-2668", "CVE-2017-7551");
    
      script_name(english:"openSUSE Security Update : 389-ds (openSUSE-2017-1396)");
      script_summary(english:"Check for the openSUSE-2017-1396 patch");
    
      script_set_attribute(
        attribute:"synopsis", 
        value:"The remote openSUSE host is missing a security update."
      );
      script_set_attribute(
        attribute:"description", 
        value:
    "This update for 389-ds fixes the following issues :
    
      - CVE-2017-7551: 389-ds-base: Password brute-force
        possible for locked account due to different return
        codes (bsc#1051997)
    
      - CVE-2016-4992: 389-ds: Information disclosure via
        repeated use of LDAP ADD operation (bsc#997256)
    
      - CVE-2016-5405: 389-ds: Password verification vulnerable
        to timing attack (bsc#1007004)
    
      - CVE-2017-2591: 389-ds-base: Heap buffer overflow in
        uiduniq.c (bsc#1020670)
    
      - CVE-2017-2668 389-ds Remote crash via crafted LDAP
        messages (bsc#1069067)
    
      - CVE-2016-0741: 389-ds: worker threads do not detect
        abnormally closed connections causing DoS (bsc#1069074)"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://bugzilla.opensuse.org/show_bug.cgi?id=1007004"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://bugzilla.opensuse.org/show_bug.cgi?id=1020670"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://bugzilla.opensuse.org/show_bug.cgi?id=1051997"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://bugzilla.opensuse.org/show_bug.cgi?id=1069067"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://bugzilla.opensuse.org/show_bug.cgi?id=1069074"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://bugzilla.opensuse.org/show_bug.cgi?id=997256"
      );
      script_set_attribute(
        attribute:"solution", 
        value:"Update the affected 389-ds packages."
      );
      script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:N/C:N/I:N/A:C");
      script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H");
    
      script_set_attribute(attribute:"plugin_type", value:"local");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:389-ds");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:389-ds-debuginfo");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:389-ds-debugsource");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:389-ds-devel");
      script_set_attribute(attribute:"cpe", value:"cpe:/o:novell:opensuse:42.2");
      script_set_attribute(attribute:"cpe", value:"cpe:/o:novell:opensuse:42.3");
    
      script_set_attribute(attribute:"patch_publication_date", value:"2017/12/18");
      script_set_attribute(attribute:"plugin_publication_date", value:"2017/12/19");
      script_end_attributes();
    
      script_category(ACT_GATHER_INFO);
      script_copyright(english:"This script is Copyright (C) 2017-2020 Tenable Network Security, Inc.");
      script_family(english:"SuSE Local Security Checks");
    
      script_dependencies("ssh_get_info.nasl");
      script_require_keys("Host/local_checks_enabled", "Host/SuSE/release", "Host/SuSE/rpm-list", "Host/cpu");
    
      exit(0);
    }
    
    
    include("audit.inc");
    include("global_settings.inc");
    include("rpm.inc");
    
    if (!get_kb_item("Host/local_checks_enabled")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);
    release = get_kb_item("Host/SuSE/release");
    if (isnull(release) || release =~ "^(SLED|SLES)") audit(AUDIT_OS_NOT, "openSUSE");
    if (release !~ "^(SUSE42\.2|SUSE42\.3)$") audit(AUDIT_OS_RELEASE_NOT, "openSUSE", "42.2 / 42.3", release);
    if (!get_kb_item("Host/SuSE/rpm-list")) audit(AUDIT_PACKAGE_LIST_MISSING);
    
    ourarch = get_kb_item("Host/cpu");
    if (!ourarch) audit(AUDIT_UNKNOWN_ARCH);
    if (ourarch !~ "^(i586|i686|x86_64)$") audit(AUDIT_ARCH_NOT, "i586 / i686 / x86_64", ourarch);
    
    flag = 0;
    
    if ( rpm_check(release:"SUSE42.2", reference:"389-ds-1.3.4.5-5.5.1") ) flag++;
    if ( rpm_check(release:"SUSE42.2", reference:"389-ds-debuginfo-1.3.4.5-5.5.1") ) flag++;
    if ( rpm_check(release:"SUSE42.2", reference:"389-ds-debugsource-1.3.4.5-5.5.1") ) flag++;
    if ( rpm_check(release:"SUSE42.2", reference:"389-ds-devel-1.3.4.5-5.5.1") ) flag++;
    if ( rpm_check(release:"SUSE42.3", reference:"389-ds-1.3.4.5-8.1") ) flag++;
    if ( rpm_check(release:"SUSE42.3", reference:"389-ds-debuginfo-1.3.4.5-8.1") ) flag++;
    if ( rpm_check(release:"SUSE42.3", reference:"389-ds-debugsource-1.3.4.5-8.1") ) flag++;
    if ( rpm_check(release:"SUSE42.3", reference:"389-ds-devel-1.3.4.5-8.1") ) flag++;
    
    if (flag)
    {
      if (report_verbosity > 0) security_hole(port:0, extra:rpm_report_get());
      else security_hole(0);
      exit(0);
    }
    else
    {
      tested = pkg_tests_get();
      if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);
      else audit(AUDIT_PACKAGE_NOT_INSTALLED, "389-ds / 389-ds-debuginfo / 389-ds-debugsource / 389-ds-devel");
    }
    
  • NASL familyHuawei Local Security Checks
    NASL idEULEROS_SA-2018-1190.NASL
    descriptionAccording to the versions of the 389-ds-base packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : - It was found that 389-ds-base did not properly handle long search filters with characters needing escapes, possibly leading to buffer overflows. A remote, unauthenticated attacker could potentially use this flaw to make ns-slapd crash via a specially crafted LDAP request, thus resulting in denial of service.(CVE-2018-1089) - It was found that the uniqueness_entry_to_config() function, used by the
    last seen2020-05-06
    modified2018-07-03
    plugin id110854
    published2018-07-03
    reporterThis script is Copyright (C) 2018-2020 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/110854
    titleEulerOS 2.0 SP2 : 389-ds-base (EulerOS-SA-2018-1190)
    code
    #
    # (C) Tenable Network Security, Inc.
    #
    
    include("compat.inc");
    
    if (description)
    {
      script_id(110854);
      script_version("1.6");
      script_set_attribute(attribute:"plugin_modification_date", value:"2020/05/04");
    
      script_cve_id(
        "CVE-2017-2591",
        "CVE-2018-1089"
      );
    
      script_name(english:"EulerOS 2.0 SP2 : 389-ds-base (EulerOS-SA-2018-1190)");
      script_summary(english:"Checks the rpm output for the updated packages.");
    
      script_set_attribute(attribute:"synopsis", value:
    "The remote EulerOS host is missing multiple security updates.");
      script_set_attribute(attribute:"description", value:
    "According to the versions of the 389-ds-base packages installed, the
    EulerOS installation on the remote host is affected by the following
    vulnerabilities :
    
      - It was found that 389-ds-base did not properly handle
        long search filters with characters needing escapes,
        possibly leading to buffer overflows. A remote,
        unauthenticated attacker could potentially use this
        flaw to make ns-slapd crash via a specially crafted
        LDAP request, thus resulting in denial of
        service.(CVE-2018-1089)
    
      - It was found that the uniqueness_entry_to_config()
        function, used by the 'attribute uniqueness' plugin of
        389 Directory Server, did not properly NULL terminate
        an array used in some configuration. An authenticated,
        or possibly unauthenticated, attacker could use this
        flaw to force an out-of-bound heap memory read,
        possibly triggering a crash of the LDAP
        service.(CVE-2017-2591)
    
    Note that Tenable Network Security has extracted the preceding
    description block directly from the EulerOS security advisory. Tenable
    has attempted to automatically clean and format it as much as possible
    without introducing additional issues.");
      # https://developer.huaweicloud.com/ict/en/site-euleros/euleros/security-advisories/EulerOS-SA-2018-1190
      script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?ac784d37");
      script_set_attribute(attribute:"solution", value:
    "Update the affected 389-ds-base packages.");
      script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:N/C:N/I:N/A:P");
      script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H");
    
      script_set_attribute(attribute:"patch_publication_date", value:"2018/06/19");
      script_set_attribute(attribute:"plugin_publication_date", value:"2018/07/03");
    
      script_set_attribute(attribute:"plugin_type", value:"local");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:huawei:euleros:389-ds-base");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:huawei:euleros:389-ds-base-libs");
      script_set_attribute(attribute:"cpe", value:"cpe:/o:huawei:euleros:2.0");
      script_set_attribute(attribute:"generated_plugin", value:"current");
      script_end_attributes();
    
      script_category(ACT_GATHER_INFO);
      script_family(english:"Huawei Local Security Checks");
    
      script_copyright(english:"This script is Copyright (C) 2018-2020 and is owned by Tenable, Inc. or an Affiliate thereof.");
    
      script_dependencies("ssh_get_info.nasl");
      script_require_keys("Host/local_checks_enabled", "Host/EulerOS/release", "Host/EulerOS/rpm-list", "Host/EulerOS/sp");
      script_exclude_keys("Host/EulerOS/uvp_version");
    
      exit(0);
    }
    
    include("audit.inc");
    include("global_settings.inc");
    include("rpm.inc");
    
    if (!get_kb_item("Host/local_checks_enabled")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);
    
    release = get_kb_item("Host/EulerOS/release");
    if (isnull(release) || release !~ "^EulerOS") audit(AUDIT_OS_NOT, "EulerOS");
    if (release !~ "^EulerOS release 2\.0(\D|$)") audit(AUDIT_OS_NOT, "EulerOS 2.0");
    
    sp = get_kb_item("Host/EulerOS/sp");
    if (isnull(sp) || sp !~ "^(2)$") audit(AUDIT_OS_NOT, "EulerOS 2.0 SP2");
    
    uvp = get_kb_item("Host/EulerOS/uvp_version");
    if (!empty_or_null(uvp)) audit(AUDIT_OS_NOT, "EulerOS 2.0 SP2", "EulerOS UVP " + uvp);
    
    if (!get_kb_item("Host/EulerOS/rpm-list")) audit(AUDIT_PACKAGE_LIST_MISSING);
    
    cpu = get_kb_item("Host/cpu");
    if (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);
    if ("x86_64" >!< cpu && cpu !~ "^i[3-6]86$" && "aarch64" >!< cpu) audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, "EulerOS", cpu);
    if ("x86_64" >!< cpu && cpu !~ "^i[3-6]86$") audit(AUDIT_ARCH_NOT, "i686 / x86_64", cpu);
    
    flag = 0;
    
    pkgs = ["389-ds-base-1.3.5.10-20.h5",
            "389-ds-base-libs-1.3.5.10-20.h5"];
    
    foreach (pkg in pkgs)
      if (rpm_check(release:"EulerOS-2.0", sp:"2", reference:pkg)) flag++;
    
    if (flag)
    {
      security_report_v4(
        port       : 0,
        severity   : SECURITY_WARNING,
        extra      : rpm_report_get()
      );
      exit(0);
    }
    else
    {
      tested = pkg_tests_get();
      if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);
      else audit(AUDIT_PACKAGE_NOT_INSTALLED, "389-ds-base");
    }