SASL UNBIND DoS in 389 Directory Server

Executive Summary

This vulnerability affects 389-ds-base, an LDAP server. It involves a flaw in the SASL UNBIND process where a remote authenticated attacker can send a specially crafted request to stall a connection. This leads to resource exhaustion and a Denial of Service (DoS) for the server.

Useful 0 Not Useful 0

Detection Guidance

Monitor 389-ds-base service logs for stalled connections or resource exhaustion events. Check for repeated SASL UNBIND requests larger than the default 512-byte buffer. Use network monitoring tools like tcpdump to capture LDAP traffic and identify malformed UNBIND requests.

Useful 0 Not Useful 0

Impact Analysis

The vulnerability allows an authenticated attacker to cause a server to stall by sending oversized UNBIND requests. This exhausts server resources, leading to a DoS condition. The attack requires authentication, so only authorized users can exploit it.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could impact compliance with GDPR and HIPAA by enabling denial-of-service attacks that disrupt LDAP server availability. Resource exhaustion from stalled connections may lead to unauthorized access or service disruptions, violating availability requirements in these regulations.

Useful 0 Not Useful 0

Mitigation Strategies

Restrict network access to 389-ds-base using firewall rules to allow only trusted IP addresses or subnets. Limit inbound connections to LDAP ports 389 and 636. Consider upgrading to a patched version of 389-ds-base if available.

Useful 0 Not Useful 0