CVE-2014-0132

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2014-0132
The SASL authentication functionality in 389 Directory Server before 1.2.11.26 allows remote authenticated users to connect as an arbitrary user and gain privileges via the authzid parameter in a SASL/GSSAPI bind.

6.5 /10

CVSS v2.0 : MEDIUM

V2 Legend

Vector : AV:N/AC:L/Au:S/C:P/I:P/A:P

Exploitability : 8.0 / Impact : 6.4

Access Vector NETWORK

Access Complexity LOW

Authentication SINGLE

Confidentiality Impact PARTIAL

Integrity Impact PARTIAL

Availability Impact PARTIAL

References
Link Resource
http://rhn.redhat.com/errata/RHSA-2014-0292.html
http://secunia.com/advisories/57412 Vendor Advisory
http://secunia.com/advisories/57427 Vendor Advisory
https://fedorahosted.org/389/changeset/76acff12a86110d4165f94e2cba13ef5c7ebc38a/ Exploit
https://fedorahosted.org/389/ticket/47739 Patch
Configurations

Configuration 1 (hide)

OR cpe:2.3:a:fedoraproject:389_directory_server:*:*:*:*:*:*:*:*
cpe:2.3:a:fedoraproject:389_directory_server:1.2.11.1:*:*:*:*:*:*:*
cpe:2.3:a:fedoraproject:389_directory_server:1.2.11.5:*:*:*:*:*:*:*
cpe:2.3:a:fedoraproject:389_directory_server:1.2.11.6:*:*:*:*:*:*:*
cpe:2.3:a:fedoraproject:389_directory_server:1.2.11.8:*:*:*:*:*:*:*
cpe:2.3:a:fedoraproject:389_directory_server:1.2.11.9:*:*:*:*:*:*:*
cpe:2.3:a:fedoraproject:389_directory_server:1.2.11.10:*:*:*:*:*:*:*
cpe:2.3:a:fedoraproject:389_directory_server:1.2.11.11:*:*:*:*:*:*:*
cpe:2.3:a:fedoraproject:389_directory_server:1.2.11.12:*:*:*:*:*:*:*
cpe:2.3:a:fedoraproject:389_directory_server:1.2.11.13:*:*:*:*:*:*:*
cpe:2.3:a:fedoraproject:389_directory_server:1.2.11.14:*:*:*:*:*:*:*
cpe:2.3:a:fedoraproject:389_directory_server:1.2.11.15:*:*:*:*:*:*:*
cpe:2.3:a:fedoraproject:389_directory_server:1.2.11.17:*:*:*:*:*:*:*
cpe:2.3:a:fedoraproject:389_directory_server:1.2.11.19:*:*:*:*:*:*:*
cpe:2.3:a:fedoraproject:389_directory_server:1.2.11.20:*:*:*:*:*:*:*
cpe:2.3:a:fedoraproject:389_directory_server:1.2.11.21:*:*:*:*:*:*:*
cpe:2.3:a:fedoraproject:389_directory_server:1.2.11.22:*:*:*:*:*:*:*
cpe:2.3:a:fedoraproject:389_directory_server:1.2.11.23:*:*:*:*:*:*:*
History

13 Feb 2023, 00:32

Type Values Removed Values Added
Summary CVE-2014-0132 389-ds: flaw in parsing authzid can lead to privilege escalation The SASL authentication functionality in 389 Directory Server before 1.2.11.26 allows remote authenticated users to connect as an arbitrary user and gain privileges via the authzid parameter in a SASL/GSSAPI bind.
References
  • {'url': 'https://bugzilla.redhat.com/show_bug.cgi?id=1074845', 'name': 'https://bugzilla.redhat.com/show_bug.cgi?id=1074845', 'tags': [], 'refsource': 'MISC'}
  • {'url': 'https://access.redhat.com/errata/RHSA-2014:0292', 'name': 'https://access.redhat.com/errata/RHSA-2014:0292', 'tags': [], 'refsource': 'MISC'}
  • {'url': 'https://access.redhat.com/security/cve/CVE-2014-0132', 'name': 'https://access.redhat.com/security/cve/CVE-2014-0132', 'tags': [], 'refsource': 'MISC'}

02 Feb 2023, 20:16

Type Values Removed Values Added
Summary The SASL authentication functionality in 389 Directory Server before 1.2.11.26 allows remote authenticated users to connect as an arbitrary user and gain privileges via the authzid parameter in a SASL/GSSAPI bind. CVE-2014-0132 389-ds: flaw in parsing authzid can lead to privilege escalation
References
  • (MISC) https://bugzilla.redhat.com/show_bug.cgi?id=1074845 -
  • (MISC) https://access.redhat.com/errata/RHSA-2014:0292 -
  • (MISC) https://access.redhat.com/security/cve/CVE-2014-0132 -
Information

Published : 2014-03-18 17:02

Updated : 2023-12-10 11:31

NVD link : CVE-2014-0132

Mitre link : CVE-2014-0132

CVE.ORG link : CVE-2014-0132

JSON object : View

Products Affected

fedoraproject

  • 389_directory_server
CWE
CWE-287

Improper Authentication