Access Control Vulnerability in 389 Directory Server by Red Hat

CVE-2013-1897

Summary

The do_search function within the 389 Directory Server could allow remote attackers to gain unauthorized access to sensitive information. This occurs due to insufficient access restrictions when the nsslapd-allow-anonymous-access setting is configured to grant access to the rootDSE. When the BASE search scope is utilized, attackers can exploit this flaw via a crafted LDAP search, potentially exposing critical data that should have remained protected.

References