Description
389 Directory Server 1.2.10 does not properly update the ACL when a DN entry is moved by a modrdn operation, which allows remote authenticated users with certain permissions to bypass ACL restrictions and access the DN entry.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 13 | 389-ds-base | 1.2.11.15-1 | — |
| Debian 12 | 389-ds-base | 1.2.11.15-1 | — |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 6 | 389-ds-base +2 | 1.2.11.15-11.el6 | RHSA-2013:0503 |
Advisories 1
- RHSA-2013:0503 Red Hat Security Advisory: 389-ds-base security, bug fix, and enhancement update Red Hat Security Advisories (RHSA) · Jun 26, 2026
References
- https://bugzilla.redhat.com/show_bug.cgi?id=860772
- https://fedorahosted.org/389/ticket/340
- http://git.fedorahosted.org/cgit/389/ds.git/commit/?id=5beb93d42efb807838c09c5fab898876876f8d09
- 50713 third-party-advisory
- RHSA-2013:0503 vendor-advisory
- [oss-security] 20120926 CVE Request -- 389-ds-base: Change on SLAPI_MODRDN_NEWSUPERIOR is not evaluated in ACL (ACL rules bypass possible) mailing-list
- [oss-security] 20120926 Re: CVE Request -- 389-ds-base: Change on SLAPI_MODRDN_NEWSUPERIOR is not evaluated in ACL (ACL rules bypass possible) mailing-list
- 55690 vdb-entry