遠端主機上安裝的 389-ds-base 版本為 1.3.10.2-12 之前版本。因此，它受到 ALAS2-2021-1650 公告中提及的一個弱點影響。

  - 在驗證期間針對 DN 進行繫結時，不論 DN 是否存在，389-ds-base 的回覆都會有所不同。未經驗證的攻擊者可利用此弱點，檢查 LDAP 資料庫中是否存在某個項目。(CVE-2020-35518)

請注意，Nessus 並未測試此問題，而是僅依據應用程式自我報告的版本號碼作出判斷。

遠端 Redhat Enterprise Linux 8 主機上安裝的多個套件受到 RHSA-2021: 1258 公告中提及的弱點影響。

  - 389-ds-base：在 DN 繫結期間會發生資訊洩漏 (CVE-2020-35518)

請注意，Nessus 並未測試此問題，而是僅依據應用程式自我報告的版本號碼。

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2021:2323 advisory.

    389 Directory Server is an LDAP version 3 (LDAPv3) compliant server. The base packages include the     Lightweight Directory Access Protocol (LDAP) server and command-line utilities for server administration.

    Security Fix(es):

    * 389-ds-base: information disclosure during the binding of a DN (CVE-2020-35518)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

    Bug Fix(es):

    * Add new access log keywords for time spent in work queue and actual operation time (BZ#1953673)

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2021:0599 advisory.

    Red Hat Directory Server is an LDAPv3-compliant directory server. The suite of packages includes the     Lightweight Directory Access Protocol (LDAP) server and command-line utilities for server administration,     the Administration Server HTTP agent package, and the GUI console packages.

    Security Fix(es):

    * 389-ds-base: information disclosure during the binding of a DN (CVE-2020-35518)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

    Bug Fix(es):

    * RHDS11: write permission of ACI changes ns-slapds behavior on search operation (BZ#1909675)

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2021:1258 advisory.

    389 Directory Server is an LDAP version 3 (LDAPv3) compliant server. The base packages include the     Lightweight Directory Access Protocol (LDAP) server and command-line utilities for server administration.

    Security Fix(es):

    * 389-ds-base: information disclosure during the binding of a DN (CVE-2020-35518)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

    Bug Fix(es):

    * Replication now resolves entry conflicts during a modrdn operation (BZ#1946631)

    * Searches by an unauthorized client can no longer determine if an entry exists or not by the result code     (BZ#1946634)

    Users of Red Hat Directory Server 11 are advised to install these updated packages.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote NewStart CGSL host, running version CORE 5.05 / MAIN 5.05, has 389-ds-base packages installed that are affected by a vulnerability:

  - When binding against a DN during authentication, the reply from 389-ds-base will be different whether the     DN exists or not. This can be used by an unauthenticated attacker to check the existence of an entry in     the LDAP database. (CVE-2020-35518)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of 389-ds-base installed on the remote host is prior to 1.3.10.2-12. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2021-1650 advisory.

    When binding against a DN during authentication, the reply from 389-ds-base will be different whether the     DN exists or not. This can be used by an unauthenticated attacker to check the existence of an entry in     the LDAP database. (CVE-2020-35518)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

遠端 Oracle Linux 7 主機上安裝的套件受到 ELSA-2021-2323 公告中提及的一個弱點影響。

  - 在驗證期間針對 DN 進行繫結時，不論 DN 是否存在，389-ds-base 的回覆都會有所不同。未經驗證的攻擊者可利用此弱點，檢查 LDAP 資料庫中是否存在某個項目。(CVE-2020-35518)

請注意，Nessus 並未測試此問題，而是僅依據應用程式自我報告的版本號碼。

遠端 Scientific Linux 7 主機上安裝的多個套件受到 SLSA-2021: 2323-1 公告中提及的一個弱點影響。

  - 389-ds-base：在 DN 繫結期間會發生資訊洩漏 (CVE-2020-35518)

請注意，Nessus 並未測試此問題，而是僅依據應用程式自我報告的版本號碼。

遠端 CentOS Linux 7 主機上安裝的套件受到 RHSA-2021:2323 公告中提及的弱點影響。

  - 在驗證期間針對 DN 進行繫結時，不論 DN 是否存在，389-ds-base 的回覆都會有所不同。未經驗證的攻擊者可利用此弱點，檢查 LDAP 資料庫中是否存在某個項目。(CVE-2020-35518)

請注意，Nessus 並未測試此問題，而是僅依據應用程式自我報告的版本號碼作出判斷。

遠端 Ubuntu 16.04 ESM / 18.04 ESM / 20.04 ESM 主機上安裝的多個套件受到 USN-5231-1 公告中提及的多個弱點影響 。

  - 在驗證期間針對 DN 進行繫結時，不論 DN 是否存在，389-ds-base 的回覆都會有所不同。未經驗證的攻擊者可利用此弱點，檢查 LDAP 資料庫中是否存在某個項目。(CVE-2020-35518)

  - 在 389-ds-base 中使用 sync_repl 用戶端時，經驗證的攻擊者可使用特製的查詢造成 NULL 指標解除參照，進而導致當機。(CVE-2021-3514)

請注意，Nessus 並未測試這些問題，而是僅依據應用程式自我報告的版本號碼作出判斷。

ID	名前	製品	ファミリー	公開日	更新日	深刻度
169520	Amazon Linux 2：389-ds-base (ALAS-2021-1650)	Nessus	Amazon Linux Local Security Checks	2023/1/4	2024/12/11	medium
148807	RHEL 8：389-ds: 1.4 (RHSA-2021: 1258)	Nessus	Red Hat Local Security Checks	2021/4/19	2024/11/7	medium
150381	RHEL 7 : 389-ds-base (RHSA-2021:2323)	Nessus	Red Hat Local Security Checks	2021/6/9	2024/11/7	medium
194283	RHEL 8 : redhat-ds:11 (RHSA-2021:0599)	Nessus	Red Hat Local Security Checks	2024/4/28	2024/11/7	medium
148807	RHEL 8 : 389-ds:1.4 (RHSA-2021:1258)	Nessus	Red Hat Local Security Checks	2021/4/19	2024/11/7	medium
160825	NewStart CGSL CORE 5.05 / MAIN 5.05 : 389-ds-base Vulnerability (NS-SA-2022-0026)	Nessus	NewStart CGSL Local Security Checks	2022/5/10	2022/5/10	medium
169520	Amazon Linux 2 : 389-ds-base (ALAS-2021-1650)	Nessus	Amazon Linux Local Security Checks	2023/1/4	2024/12/11	medium
150429	Oracle Linux 7：389-ds-base (ELSA-2021-2323)	Nessus	Oracle Linux Local Security Checks	2021/6/9	2024/10/22	medium
150710	Scientific Linux 安全性更新：SL7.x x86_64 上的 389-ds-base (2021:2323)	Nessus	Scientific Linux Local Security Checks	2021/6/11	2021/6/11	medium
150772	CentOS 7：389-ds-base (RHSA-2021:2323)	Nessus	CentOS Local Security Checks	2021/6/14	2024/10/9	medium
183133	Ubuntu 16.04 ESM / 18.04 ESM / 20.04 ESM：389 Directory Server 弱點 (USN-5231-1)	Nessus	Ubuntu Local Security Checks	2023/10/16	2024/8/27	medium

検出

プラグインの検索

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium