CVE-2017-7551 Red Hat Update for 389-ds-base (RHSA-2017:2569)

漏洞类别:RedHat

漏洞等级:

漏洞信息

389 Directory Server is an LDAP version 3 (LDAPv3) compliant server.

A flaw was found in the way 389-ds-base handled authentication attempts against locked accounts. A remote attacker could potentially use this flaw to continue password brute-forcing attacks against LDAP accounts, thereby bypassing the protection offered by the directory server’s password lockout policy. (CVE-2017-7551)
Affected Products
Red Hat Enterprise Linux Server 7 x86_64
Red Hat Enterprise Linux Server – Extended Update Support 7.4 x86_64
Red Hat Enterprise Linux Server – AUS 7.4 x86_64
Red Hat Enterprise Linux Workstation 7 x86_64
Red Hat Enterprise Linux Desktop 7 x86_64
Red Hat Enterprise Linux for IBM z Systems 7 s390x
Red Hat Enterprise Linux for IBM z Systems – Extended Update Support 7.4 s390x
Red Hat Enterprise Linux for Power, big endian 7 ppc64
Red Hat Enterprise Linux for Power, big endian – Extended Update Support 7.4 ppc64
Red Hat Enterprise Linux for Scientific Computing 7 x86_64
Red Hat Enterprise Linux EUS Compute Node 7.4 x86_64
Red Hat Enterprise Linux for Power, little endian 7 ppc64le
Red Hat Enterprise Linux for Power, little endian – Extended Update Support 7.4 ppc64le
Red Hat Enterprise Linux Server for ARM 7 aarch64
Red Hat Enterprise Linux Server – TUS 7.4 x86_64
Red Hat Enterprise Linux Server (for IBM Power LE) – 4 Year Extended Update Support 7.4 ppc64le
Red Hat Enterprise Linux Server – 4 Year Extended Update Support 7.4 x86_64

漏洞危害

A remote attacker could potentially use this flaw to continue password brute-forcing attacks against LDAP accounts, thereby bypassing the protection offered by the directory server’s password lockout policy.

解决方案

Upgrade to the latest packages which contain a patch. Refer to Applying Package Updates to RHEL system for details.

Refer to Red Hat security advisory RHSA-2017:2569 to address this issue and obtain more information.

Patch:
Following are links for downloading patches to fix the vulnerabilities:

RHSA-2017:2569: Red Hat Enterprise Linux

Leave a Reply