CVSS: 4.0EPSS: 0%CPEs: 42EXPL: 0CVE-2012-2678 – rhds/389: plaintext password disclosure flaw
https://notcve.org/view.php?id=CVE-2012-2678
389 Directory Server before 1.2.11.6 (aka Red Hat Directory Server before 8.2.10-3), after the password for a LDAP user has been changed and before the server has been reset, allows remote attackers to read the plaintext password via the unhashed#user#password attribute. "389 Directory Server" antes de v1.2.11.6 (también conocido como Red Hat Directory Server antes de v8.2.10-3), cuando la contraseña de un usuario de LDAP ha cambiado y anyes de que el servidor haya sido reiniciado, permite a atacantes remotos leer contraseñas en claro a través del atributo unhashed#user#password. • http://directory.fedoraproject.org/wiki/Release_Notes http://osvdb.org/83336 http://rhn.redhat.com/errata/RHSA-2012-0997.html http://rhn.redhat.com/errata/RHSA-2012-1041.html http://secunia.com/advisories/49734 http://www.securityfocus.com/bid/54153 https://h20564.www2.hp.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c03772083 https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A19353 https://access.redhat.com/security/cve/CVE-2012-267 • CWE-310: Cryptographic Issues •
CVSS: 2.1EPSS: 0%CPEs: 42EXPL: 0CVE-2012-2746 – rhds/389: plaintext password disclosure in audit log
https://notcve.org/view.php?id=CVE-2012-2746
389 Directory Server before 1.2.11.6 (aka Red Hat Directory Server before 8.2.10-3), when the password of a LDAP user has been changed and audit logging is enabled, saves the new password to the log in plain text, which allows remote authenticated users to read the password. "389 Directory Server" antes de v1.2.11.6 (también conocido como Red Hat Directory Server antes de v8.2.10-3), cuando la contraseña de un usuario de LDAP ha cambiado y el registro de auditoría está habilitada, guarda la nueva contraseña para el registro en texto plano, lo que permite leer la contraseña a usuarios remotos autenticados. • http://directory.fedoraproject.org/wiki/Release_Notes http://rhn.redhat.com/errata/RHSA-2012-0997.html http://rhn.redhat.com/errata/RHSA-2012-1041.html http://secunia.com/advisories/49734 http://www.osvdb.org/83329 http://www.securityfocus.com/bid/54153 https://bugzilla.redhat.com/show_bug.cgi?id=833482 https://exchange.xforce.ibmcloud.com/vulnerabilities/76595 https://fedorahosted.org/389/ticket/365 https://h20564.www2.hp.com/portal/site/hpsc/public/kb/docDisplay?docId=em • CWE-310: Cryptographic Issues •
CVSS: 3.3EPSS: 0%CPEs: 4EXPL: 0CVE-2010-3282
https://notcve.org/view.php?id=CVE-2010-3282
389 Directory Server before 1.2.7.1 (aka Red Hat Directory Server 8.2) and HP-UX Directory Server before B.08.10.03, when audit logging is enabled, logs the Directory Manager password (nsslapd-rootpw) in cleartext when changing cn=config:nsslapd-rootpw, which might allow local users to obtain sensitive information by reading the log. 389 Directory Server versiones anteriores a 1.2.7.1 (también se conoce como Red Hat Directory Server versión 8.2) y HP-UX Directory Server versiones anteriores a B.08.10.03, cuando el registro de auditoría está habilitado, registra la contraseña de Directory Manager (nsslapd-rootpw) en texto sin cifrar cuando se cambia cn=config:nsslapd-rootpw, que podría permitir a usuarios locales obtener información confidencial mediante la lectura del registro. • http://oval.mitre.org/repository/data/getDef?id=oval:org.mitre.oval:def:6914 https://bugzilla.redhat.com/show_bug.cgi?id=625950 https://git.fedorahosted.org/cgit/389/ds.git/commit/?id=d38ae06 https://support.hpe.com/hpsc/doc/public/display?docId=emr_na-c02522633&docLocale=en_US • CWE-312: Cleartext Storage of Sensitive Information •
CVSS: 4.6EPSS: 0%CPEs: 2EXPL: 0CVE-2010-2241 – redhat-ds: setup script insecure .inf file permissions
https://notcve.org/view.php?id=CVE-2010-2241
The (1) setup-ds.pl and (2) setup-ds-admin.pl setup scripts for Red Hat Directory Server 8 before 8.2 use world-readable permissions when creating cache files, which allows local users to obtain sensitive information including passwords for Directory and Administration Server administrative accounts. Los scripts de configuración (1) setup-ds.pl y (2) setup-ds-admin.pl para Red Hat Directory Server v8 anterior a v8.2 usa permisos de lectura para todos "world-readable" cuando crea ficheros de cache, lo cual permite a usuarios locales obtener información sensible incluyendo contraseñas de cuentas administrativas de Directory y Administration Server. • http://rhn.redhat.com/errata/RHSA-2010-0590.html http://secunia.com/advisories/40811 http://www.osvdb.org/66962 http://www.securitytracker.com/id?1024281 https://bugzilla.redhat.com/show_bug.cgi?id=608032 https://access.redhat.com/security/cve/CVE-2010-2241 • CWE-264: Permissions, Privileges, and Access Controls •
CVSS: 7.8EPSS: 11%CPEs: 8EXPL: 0CVE-2008-3283 – Server: multiple memory leaks
https://notcve.org/view.php?id=CVE-2008-3283
Multiple memory leaks in Red Hat Directory Server 7.1 before SP7, Red Hat Directory Server 8, and Fedora Directory Server 1.1.1 and earlier allow remote attackers to cause a denial of service (memory consumption) via vectors involving (1) the authentication / bind phase and (2) anonymous LDAP search requests. Múltiples fugas de memoria en Red Hat Directory Server 7.1 anteriores al SP7, Red Hat Directory Server 8, y Fedora Directory Server 1.1.1 y anteriores, permiten a atacantes remotos provocar una denegación de servicio (consumo de memoria) a través de vectores que involucran: (1) la fase de autenticación/asignación y (2) peticiones de búsqueda LDAP anónimas. • http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c01532861 http://secunia.com/advisories/31565 http://secunia.com/advisories/31627 http://secunia.com/advisories/31702 http://secunia.com/advisories/31867 http://secunia.com/advisories/31913 http://securitytracker.com/id?1020774 http://www.redhat.com/docs/manuals/dir-server/release-notes/7.1SP7/index.html http://www.redhat.com/support/errata/RHSA-2008-0602.html http://www.redhat.com/support/errata/RHSA-2008-0 • CWE-399: Resource Management Errors CWE-401: Missing Release of Memory after Effective Lifetime •