Executive brief
A security vulnerability exists in the 389 Directory Server, a service used to manage user identities and access across corporate networks. An attacker with basic user credentials can send a specially crafted network packet to crash the server or potentially take full control of the system. This could lead to a total service outage or unauthorized access to sensitive identity data in environments like FreeIPA and Red Hat Identity Management.
Technical details
An integer overflow vulnerability exists in the SASL I/O layer of 389-ds-base within the `sasl_io_start_packet()` function in `sasl_io.c`. By providing a crafted 4-byte SASL packet length prefix (0xFFFFFFFC), the addition of `sizeof(uint32_t)` causes an unsigned integer wraparound to zero. This bypasses the `nsslapd-maxsasliosize` limit check. Subsequent processing in `sasl_io_read_packet()` results in a buffer underflow calculation, causing NSPR to read up to 2MB of attacker-controlled data into a 1024-byte heap buffer. Exploitation requires a successful SASL bind (e.g., via Kerberos or DIGEST-MD5) with integrity protection enabled (SSF > 0). While the overflow can reliably cause a Denial of Service, Remote Code Execution has been demonstrated on older glibc versions (e.g., 2.28) via tcache poisoning.
Affected products
- 389 Directory Server Project 389-ds-base All versions prior to fix
- FreeIPA Project FreeIPA
- Red Hat Red Hat Identity Management
Timeline
- 2026-06-04: disclosed: Reported via Red Hat Bugzilla
- 2026-06-11: advisory: CVE published by Red Hat