389-ds-base (SL6)

Synopsis: Moderate: 389-ds-base security, bug fix, and enhancement update
Advisory ID: SLSA-2016:2765-1
Issue Date: 2016-11-15
CVE Numbers: CVE-2016-4992

Security Fix(es):

* It was found that 389 Directory Server was vulnerable to a flaw in which
the default ACI (Access Control Instructions) could be read by an
anonymous user. This could lead to leakage of sensitive information.

* An information disclosure flaw was found in 389 Directory Server. A user
with no access to objects in certain LDAP sub-tree could send LDAP ADD
operations with a specific object name. The error message returned to the
user was different based on whether the target object existed or not.

* It was found that 389 Directory Server was vulnerable to a remote
password disclosure via timing attack. A remote attacker could possibly
use this flaw to retrieve directory server password after many tries.

Bug Fix(es):

* Previously, a bug in the changelog iterator buffer caused it to point to
an incorrect position when reloading the buffer. This caused replication
to skip parts of the changelog, and consequently some changes were not
replicated. This bug has been fixed, and replication data loss due to an
incorrectly reloaded changelog buffer no longer occurs.

* Previously, if internal modifications were generated on a consumer (for
example by the Account Policy plug-in) and additional changes to the same
attributes were received from replication, a bug caused Directory Server
to accumulate state information on the consumer. The bug has been fixed by
making sure that replace operations are only applied if they are newer
than existing attribute deletion change sequence numbers (CSNs), and state
information no longer accumulates in this situation.


* In a multi-master replication environment where multiple masters receive
updates at the same time, it was previously possible for a single master
to obtain exclusive access to a replica and hold it for a very long time
due to problems such as a slow network connection. During this time, other
masters were blocked from accessing the same replica, which considerably
slowed down the replication process. This update adds a new configuration
attribute, “nsds5ReplicaReleaseTimeout”, which can be used to specify a
timeout in seconds. After the specified timeout period passes, the master
releases the replica, allowing other masters to access it and send their


– Scientific Linux Development Team