Executive brief
A vulnerability in the 389 Directory Server, a popular enterprise identity management service, can allow an administrator to crash the server. By uploading a specially crafted password hash, an attacker can trigger a system failure whenever that user attempts to log in. This results in a denial-of-service, preventing legitimate users from authenticating and accessing corporate resources.
Technical details
An integer underflow vulnerability exists in the SMD5 password storage plugin of 389-ds-base. The flaw occurs in smd5_pwd.c when computing the salt length by subtracting the MD5_LENGTH (16 bytes) from a decoded hash length using unsigned 32-bit arithmetic. If a stored hash is shorter than 16 bytes, the calculation wraps to approximately 4GB, causing a buffer over-read. When PK11_DigestOp() attempts to process this length, it reads into unmapped memory, resulting in a SIGSEGV and crashing the ns-slapd process. Exploitation requires Directory Manager privileges to plant the malformed hash, which then triggers the crash upon any subsequent BIND attempt.
Affected products
- 389 Project 389 Directory Server (389-ds-base) All versions since 2005
Timeline
- 2026-06-05: disclosed: Initial report in Red Hat Bugzilla
- 2026-06-09: advisory: NVD and Red Hat published advisory