Published: 18/03/2014 Updated: 13/02/2023

CVSS v2 Base Score: 6.5 | Impact Score: 6.4 | Exploitability Score: 8

VMScore: 578

Vector: AV:N/AC:L/Au:S/C:P/I:P/A:P

The SASL authentication functionality in 389 Directory Server prior to 1.2.11.26 allows remote authenticated users to connect as an arbitrary user and gain privileges via the authzid parameter in a SASL/GSSAPI bind.

Vulnerable Product	Search on Vulmon	Subscribe to Product
fedoraproject 389 directory server 1.2.11.9
fedoraproject 389 directory server 1.2.11.23
fedoraproject 389 directory server 1.2.11.8
fedoraproject 389 directory server 1.2.11.13
fedoraproject 389 directory server
fedoraproject 389 directory server 1.2.11.22
fedoraproject 389 directory server 1.2.11.21
fedoraproject 389 directory server 1.2.11.20
fedoraproject 389 directory server 1.2.11.17
fedoraproject 389 directory server 1.2.11.19
fedoraproject 389 directory server 1.2.11.12
fedoraproject 389 directory server 1.2.11.6
fedoraproject 389 directory server 1.2.11.10
fedoraproject 389 directory server 1.2.11.11
fedoraproject 389 directory server 1.2.11.1
fedoraproject 389 directory server 1.2.11.5
fedoraproject 389 directory server 1.2.11.14
fedoraproject 389 directory server 1.2.11.15

Debian Bug report logs - #741600 389-ds-base: CVE-2014-0132 Package: 389-ds-base; Maintainer for 389-ds-base is Debian FreeIPA Team <pkg-freeipa-devel@alioth-listsdebiannet>; Source for 389-ds-base is src:389-ds-base (PTS, buildd, popcon) Reported by: Moritz Muehlenhoff <jmm@inutilorg> Date: Fri, 14 Mar 2014 12:21 ...

It was discovered that the 389 Directory Server did not properly handle certain SASL-based authentication mechanisms A user able to authenticate to the directory using these SASL mechanisms could connect as any other directory user, including the administrative Directory Manager account This could allow them to modify configuration values, as wel ...

CWE-287 https://fedorahosted.org/389/changeset/76acff12a86110d4165f94e2cba13ef5c7ebc38a/https://fedorahosted.org/389/ticket/47739 http://secunia.com/advisories/57412 http://rhn.redhat.com/errata/RHSA-2014-0292.html http://secunia.com/advisories/57427 https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=741600 https://nvd.nist.gov https://alas.aws.amazon.com/ALAS-2014-311.html

CVE-2014-0132

Vulnerability Summary

Vendor Advisories

References

Vulmon Search

About

Products

Connect