Description
The setup scripts in 389 Directory Server 1.2.x (aka Red Hat Directory Server 8.2.x), when multiple unprivileged instances are configured, use 0777 permissions for the /var/run/dirsrv directory, which allows local users to cause a denial of service (daemon outage or arbitrary process termination) by replacing PID files contained in this directory.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Red Hat Directory Server 8 | redhat-ds-admin | 8.2.1-1.el5dsrv | RHSA-2011:0293 |
| Red Hat Directory Server 8 | redhat-ds-base +1 | 8.2.4-1.el5dsrv | RHSA-2011:0293 |
Advisories 1
- RHSA-2011:0293 Red Hat Security Advisory: Red Hat Directory Server security update Red Hat Security Advisories (RHSA) · Jun 28, 2026
References
- 1025102 vdb-entry
- RHSA-2011:0293 vendor-advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=671199
- 46489 vdb-entry