Executive brief
389 Directory Server is an enterprise-grade directory service used to manage user identities and permissions. A technical flaw in its audit logging feature could allow an attacker with high-level access or a compromised server connection to cause memory corruption. While this is unlikely to lead to a full system takeover, it can cause the server to crash or result in corrupted logs, hindering security monitoring and operational stability.
Technical details
A heap-based buffer overflow exists in the create_masked_entry_string() function within auditlog.c. The vulnerability is triggered when audit logging is enabled and the server processes a cleartext password shorter than 23 characters. The function uses strcpy to write a fixed 24-byte mask into a buffer sized exactly for the input string, leading to an overflow if the input is too small. Exploitation requires non-default configurations (such as CLEAR password storage) or a compromised replication peer. This can result in heap corruption, audit log inaccuracies, or potential service crashes. The issue was introduced in July 2025 and is addressed in RHEL 9.6 via 389-ds-base-2.6.1-11.el9_6.
Affected products
- Red Hat 389 Directory Server (389-ds-base) 2.6.1-11.el9_6 and later fixed; affected RHEL 9.6 and RHEL 10
Timeline
- 2025-07-01: other: Vulnerability introduced in commit bfeaa8d
- 2025-09-09: patched: Red Hat released bug fix advisory RHBA-2025:15534
- 2026-06-04: disclosed: Reported to Red Hat Bugzilla
- 2026-06-09: advisory: NVD and Red Hat published CVE details