The remote MiracleLinux 4 host has packages installed that are affected by a vulnerability as referenced in the AXSA:2017-1583:03 advisory.

    389 Directory Server is an LDAPv3 compliant server.  The base package includes     the LDAP server and command line utilities for server administration.
    Security issues fixed with this release:
    CVE-2017-2668
    ** RESERVED **     This candidate has been reserved by an organization or individual that     will use it when announcing a new security problem.  When the     candidate has been publicized, the details for this candidate will be     provided.
    Fixed bugs:
    * Previously, the deref plug-in failed to dereference attributes that use distinguished name (DN)     syntax, such as uniqueMember. With this patch, the deref plug-in can dereference such attributes and     additionally Name and Optional UID syntax. As a result, the deref plug-in now supports any syntax.

Tenable has extracted the preceding description block directly from the MiracleLinux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

An update for 389-ds-base is now available for Red Hat Enterprise Linux 6.

Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

389 Directory Server is an LDAP version 3 (LDAPv3) compliant server.
The base packages include the Lightweight Directory Access Protocol (LDAP) server and command-line utilities for server administration.

Security Fix(es) :

* An invalid pointer dereference flaw was found in the way 389-ds-base handled LDAP bind requests. A remote unauthenticated attacker could use this flaw to make ns-slapd crash via a specially crafted LDAP bind request, resulting in denial of service. (CVE-2017-2668)

Red Hat would like to thank Joachim Jabs (F24) for reporting this issue.

Bug Fix(es) :

* Previously, the 'deref' plug-in failed to dereference attributes that use distinguished name (DN) syntax, such as 'uniqueMember'. With this patch, the 'deref' plug-in can dereference such attributes and additionally 'Name and Optional UID' syntax. As a result, the 'deref' plug-in now supports any syntax. (BZ#1435365)

Note that Tenable Network Security has attempted to extract the preceding description block directly from the corresponding Red Hat security advisory. Virtuozzo provides no description for VZLSA advisories. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

An update for 389-ds-base is now available for Red Hat Enterprise Linux 6.

Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

389 Directory Server is an LDAP version 3 (LDAPv3) compliant server.
The base packages include the Lightweight Directory Access Protocol (LDAP) server and command-line utilities for server administration.

Security Fix(es) :

* An invalid pointer dereference flaw was found in the way 389-ds-base handled LDAP bind requests. A remote unauthenticated attacker could use this flaw to make ns-slapd crash via a specially crafted LDAP bind request, resulting in denial of service. (CVE-2017-2668)

Red Hat would like to thank Joachim Jabs (F24) for reporting this issue.

Bug Fix(es) :

* Previously, the 'deref' plug-in failed to dereference attributes that use distinguished name (DN) syntax, such as 'uniqueMember'. With this patch, the 'deref' plug-in can dereference such attributes and additionally 'Name and Optional UID' syntax. As a result, the 'deref' plug-in now supports any syntax. (BZ#1435365)

The remote Oracle Linux 7 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2017-0920 advisory.

    - Resolves: bug 1437005 - CVE-2017-2668 389-ds-base: Remote crash via crafted LDAP messages

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

Remote crash via crafted LDAP messages :

An invalid pointer dereference flaw was found in the way 389-ds-base handled LDAP bind requests. A remote unauthenticated attacker could use this flaw to make ns-slapd crash via a specially crafted LDAP bind request, resulting in denial of service. (CVE-2017-2668)

ID	名稱	產品	系列	已發布	已更新	嚴重性
289708	MiracleLinux 4 : 389-ds-base-1.2.11.15-91.AXS4 (AXSA:2017-1583:03)	Nessus	Miracle Linux Local Security Checks	2026/1/16	2026/1/16	medium
101444	Virtuozzo 6 : 389-ds-base / 389-ds-base-devel / 389-ds-base-libs (VZLSA-2017-0893)	Nessus	Virtuozzo Local Security Checks	2017/7/13	2025/12/11	medium
99317	CentOS 6 : 389-ds-base (CESA-2017:0893)	Nessus	CentOS Local Security Checks	2017/4/13	2021/1/4	medium
99332	Oracle Linux 7 : 389-ds-base (ELSA-2017-0920)	Nessus	Oracle Linux Local Security Checks	2017/4/13	2024/10/22	medium
99712	Amazon Linux AMI : 389-ds-base (ALAS-2017-824)	Nessus	Amazon Linux Local Security Checks	2017/4/28	2025/12/23	medium
99339	RHEL 6 : 389-ds-base (RHSA-2017:0893)	Nessus	Red Hat Local Security Checks	2017/4/13	2025/12/25	medium

偵測

搜尋 Plugin

medium

medium

medium

medium

medium

medium