Executive brief
A security flaw was found in 389 Directory Server, an enterprise-grade LDAP server used for managing user identities and permissions. An administrator with high-level privileges can cause the server to crash by providing a specially crafted, oversized security credential. While this can lead to a service outage, modern security protections in the software prevent this from being used to steal data or take over the system.
Technical details
A stack-based buffer overflow (CWE-121) exists in the checkPrefix() function within pw.c of the 389 Directory Server. The vulnerability occurs when the server parses reversible-encrypted attribute values (e.g., {SCHEME-<algid>}ciphertext); it copies an attacker-controlled algorithm ID into a fixed 256-byte stack buffer using memcpy without performing bounds checking. An attacker must possess Directory Manager privileges to exploit this by storing a crafted credential (such as nsDS5ReplicaCredentials). On production builds, the impact is limited to a Denial of Service (SIGABRT) because FORTIFY_SOURCE (__memcpy_chk) detects the overflow and terminates the process before arbitrary code execution can occur.
Affected products
- Red Hat 389 Directory Server (389-ds-base) 1.3.11.1-5.el7_9, 1.4.3.39-2.module_el8, 3.1.4-6.fc42
Timeline
- 2026-06-04: disclosed: Reported via Red Hat Bugzilla
- 2026-06-09: advisory: NVD and Red Hat published advisory details