Red Hat update for 389-ds-base



Risk Medium
Patch available YES
Number of vulnerabilities 8
CVE-ID CVE-2017-15135
CVE-2018-10540
CVE-2018-10547
CVE-2018-10549
CVE-2018-10546
CVE-2018-10548
CVE-2018-10545
CVE-2018-1054
CWE-ID CWE-287
CWE-190
CWE-79
CWE-119
CWE-835
CWE-300
CWE-200
CWE-125
Exploitation vector Network
Public exploit Public exploit code for vulnerability #4 is available.
Public exploit code for vulnerability #5 is available.
Vulnerable software
Subscribe 		Red Hat Enterprise Linux for Scientific Computing
Operating systems & Components / Operating system

Red Hat Enterprise Linux Desktop
Operating systems & Components / Operating system

Red Hat Enterprise Linux Workstation
Operating systems & Components / Operating system

Red Hat Enterprise Linux Server
Operating systems & Components / Operating system

Vendor Red Hat Inc.

Security Bulletin

This security bulletin contains information about 8 vulnerabilities.

1) Improper authentication

EUVDB-ID: #VU11126

Risk: Low

CVSSv3.1: 6.5 [CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:U]

CVE-ID: CVE-2017-15135

CWE-ID: CWE-287 - Improper Authentication

Exploit availability: No

Description

The vulnerability allows a remote unauthenticated attacker to bypass authentication on the target system.

The weakness exists due to improper handling of internal hash comparison operations. A remote attacker can bypass the authentication process.

Mitigation

Install updates from vendor's website.

Vulnerable software versions

Red Hat Enterprise Linux for Scientific Computing: 6

Red Hat Enterprise Linux Desktop: 6

Red Hat Enterprise Linux Workstation: 6

Red Hat Enterprise Linux Server: 6.0

CPE2.3 External links

http://access.redhat.com/errata/RHSA-2018:0515


Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

2) Buffer overflow

EUVDB-ID: #VU12363

Risk: Medium

CVSSv3.1: 6.5 [CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2018-10540

CWE-ID: CWE-190 - Integer overflow

Exploit availability: No

Description

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to boundary error within ParseWave64HeaderConfig function in wave64.c when processing WAV files. A remote unauthenticated attacker can create a specially crafted WAV file, trick the victim into opening it and trigger integer overflow in bytes_to_copy calculation and subsequent malloc call 

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.

Mitigation

Install updates from vendor's website.

Vulnerable software versions

Red Hat Enterprise Linux for Scientific Computing: 6

Red Hat Enterprise Linux Desktop: 6

Red Hat Enterprise Linux Workstation: 6

Red Hat Enterprise Linux Server: 6.0

CPE2.3 External links

http://access.redhat.com/errata/RHSA-2018:0515


Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

3) Cross-site scripting

EUVDB-ID: #VU12327

Risk: Low

CVSSv3.1: 5.3 [CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N/E:U/RL:O/RC:C]

CVE-ID: CVE-2018-10547

CWE-ID: CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Exploit availability: No

Description

The disclosed vulnerability allows a remote attacker to perform cross-site scripting (XSS) attacks.

The vulnerability exists in the phar_do_404() and phar_do_403() functions due to insufficient sanitization of user-supplied data processed by the phar_do_404() and phar_do_403() functions, as defined in the ext/phar/phar_object.c source code file. A remote attacker can trick the victim to follow a specially crafted link and execute arbitrary HTML and script code in user's browser in context of vulnerable website.

Successful exploitation of this vulnerability may allow a remote attacker to steal potentially sensitive information, change appearance of the web page, perform phishing and drive-by-download attacks.

The vulnerability exists due to an incomplete fix for CVE-2018-5712.

Mitigation

Install updates from vendor's website.

Vulnerable software versions

Red Hat Enterprise Linux for Scientific Computing: 6

Red Hat Enterprise Linux Desktop: 6

Red Hat Enterprise Linux Workstation: 6

Red Hat Enterprise Linux Server: 6.0

CPE2.3 External links

http://access.redhat.com/errata/RHSA-2018:0515


Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

4) Memory corruption

EUVDB-ID: #VU12258

Risk: Low

CVSSv3.1: 6.7 [CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P/RL:O/RC:C]

CVE-ID: CVE-2018-10549

CWE-ID: CWE-119 - Memory corruption

Exploit availability: No

Description

The vulnerability allows a remote attacker to cause DoS condition on the target system.

The weakness exists in exif_read_data() function due to an out-of-bounds read while processing crafted JPEG data. A remote attacker can supply a specially image file, trigger heap-based buffer overflow in exif_iif_add_value and cause the service to crash.

Mitigation

Install updates from vendor's website.

Vulnerable software versions

Red Hat Enterprise Linux for Scientific Computing: 6

Red Hat Enterprise Linux Desktop: 6

Red Hat Enterprise Linux Workstation: 6

Red Hat Enterprise Linux Server: 6.0

CPE2.3 External links

http://access.redhat.com/errata/RHSA-2018:0515


Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability. However, proof of concept for this vulnerability is available.

5) Infinite loop

EUVDB-ID: #VU12257

Risk: Low

CVSSv3.1: 6.7 [CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P/RL:O/RC:C]

CVE-ID: CVE-2018-10546

CWE-ID: CWE-835 - Loop with Unreachable Exit Condition ('Infinite Loop')

Exploit availability: No

Description

The vulnerability allows a remote attacker to cause DoS condition on the target system.

The weakness exists due to infinite loop. A remote attacker can use a stream filter with convert.iconv and not enough input bytes, trigger an infinite loop, one CPU Core at 100% and cause the service to crash.

Mitigation

Install updates from vendor's website.

Vulnerable software versions

Red Hat Enterprise Linux for Scientific Computing: 6

Red Hat Enterprise Linux Desktop: 6

Red Hat Enterprise Linux Workstation: 6

Red Hat Enterprise Linux Server: 6.0

CPE2.3 External links

http://access.redhat.com/errata/RHSA-2018:0515


Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability. However, proof of concept for this vulnerability is available.

6) Man-in-the-middle attack

EUVDB-ID: #VU12256

Risk: Low

CVSSv3.1: 5.2 [CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2018-10548

CWE-ID: CWE-300 - Channel Accessible by Non-Endpoint ('Man-in-the-Middle')

Exploit availability: No

Description

The vulnerability allows a remote attacker to cause DoS condition on the target system.

The weakness exists in the ext/ldap/ldap.c source code file due to improper handling of return values from the ldap_get_dn function. A remote attacker can use man-in-the middle techniques to trigger ldap_get_dn() to return a NULL pointer and cause ldap_get_entries() because add_assoc_string() to crash.

Mitigation

Install updates from vendor's website.

Vulnerable software versions

Red Hat Enterprise Linux for Scientific Computing: 6

Red Hat Enterprise Linux Desktop: 6

Red Hat Enterprise Linux Workstation: 6

Red Hat Enterprise Linux Server: 6.0

CPE2.3 External links

http://access.redhat.com/errata/RHSA-2018:0515


Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

7) Security restrictions bypass

EUVDB-ID: #VU11343

Risk: Low

CVSSv3.1: 4.6 [CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:U/RL:O/RC:C]

CVE-ID: CVE-2018-10545

CWE-ID: CWE-200 - Information exposure

Exploit availability: No

Description

The vulnerability allows a local attacker to bypass security restrictions and obtain potentially sensitive information on the target system.

The weakness exists due to improper access controls. A local attacker can change UID and GID, PHP-FPM sets pool worker processes to be dumpable, attach to the PHP-FPM workers and gain access to any restricted resources that are not supposed to be allowed.

Mitigation

Install updates from vendor's website.

Vulnerable software versions

Red Hat Enterprise Linux for Scientific Computing: 6

Red Hat Enterprise Linux Desktop: 6

Red Hat Enterprise Linux Workstation: 6

Red Hat Enterprise Linux Server: 6.0

CPE2.3 External links

http://access.redhat.com/errata/RHSA-2018:0515


Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

8) Out-of-bounds read

EUVDB-ID: #VU10911

Risk: Low

CVSSv3.1: 6.5 [CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2018-1054

CWE-ID: CWE-125 - Out-of-bounds read

Exploit availability: No

Description

The vulnerability allows a remote attacker to cause DoS condition on the target system.

The weakness exists in the 389-ds-base package due to out-of-bounds read when handling of certain Lightweight Directory Access Protocol (LDAP) search filters. A remote attacker can send a specially crafted LDAP request, trigger memory error and cause the ns-slapd process.

Mitigation

Install updates from vendor's website.

Vulnerable software versions

Red Hat Enterprise Linux for Scientific Computing: 6

Red Hat Enterprise Linux Desktop: 6

Red Hat Enterprise Linux Workstation: 6

Red Hat Enterprise Linux Server: 6.0

CPE2.3 External links

http://access.redhat.com/errata/RHSA-2018:0515


Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.



###SIDEBAR###