Lack of data validation In 389-ds-base
Description
A flaw was found in the 389-ds-base server. A heap buffer overflow vulnerability exists in the schema_attr_enum_callback function within the schema.c file. This occurs because the code incorrectly calculates the buffer size by summing alias string lengths without accounting for additional formatting characters. When a large number of aliases are processed, this oversight can lead to a heap overflow, potentially allowing a remote attacker to cause a Denial of Service (DoS) or achieve Remote Code Execution (RCE).
Mitigation
Update Impact
Minimal update. May introduce new vulnerabilities or breaking changes.
Ecosystem | Package | Affected version | Patched versions |
|---|---|---|---|
 debian 11 | - | ||
debian 12 | - | ||
debian 13 | 3.1.2+dfsg1-1+deb13u1 | ||
 rpm rhel6 | - | - | |
rpm rhel9 | 0:2.7.0-10.el9_7 | ||
rpm rhel10 | 0:3.1.3-7.el10_1 | ||
rpm rhel7 | - | - | |
rpm rhel10.0 | 0:3.0.6-17.el10_0 | ||
rpm rhel9.6 | 0:2.6.1-20.el9_6 | ||
rpm rhel9.4 | 0:2.4.5-24.el9_4 |
Aliases