VIR Vulnerability Intelligence Relay

CVE-2012-0833

low
Published 2012-07-03 · Modified 2026-04-29
CVSS v3
—
CVSS v2
2.3
VIR risk
2.3

Description

The acllas__handle_group_entry function in servers/plugins/acl/acllas.c in 389 Directory Server before 1.2.10 does not properly handled access control instructions (ACIs) that use certificate groups, which allows remote authenticated LDAP users with a certificate group to cause a denial of service (infinite loop and CPU consumption) by binding to the server.

Predictions

Exploit likelihood
20%
Patch ETA
—

Heuristic predictions, AS-IS, for prioritization only.

Mitigations

vendor Authored 2026-05-27

Vendor advisory: secalert@redhat.com — https://fedorahosted.org/389/changeset/1bbbb3e5049c1aa0650546efab87ed2f1ea59637/389-ds-base

vendor Authored 2026-05-27

Vendor advisory: secalert@redhat.com — http://secunia.com/advisories/49562

vendor Authored 2026-05-27

Vendor advisory: secalert@redhat.com — http://secunia.com/advisories/48035

vendor Authored 2026-05-27

Vendor advisory: debian — https://security-tracker.debian.org/tracker/CVE-2012-0833

OS impact
OSVersionStatusFixed in
debian debianbookwormfixed0
debian debiansidfixed0
debian debianbullseyefixed0
debian debiantrixiefixed0

Application impact
VendorProductVersionsFixed
fedoraproject389_directory_server{"endIncluding":"1.2.10"}
fedoraproject389_directory_server1.2.1
fedoraproject389_directory_server1.2.2
fedoraproject389_directory_server1.2.3
fedoraproject389_directory_server1.2.5
fedoraproject389_directory_server1.2.6
fedoraproject389_directory_server1.2.6.1
fedoraproject389_directory_server1.2.7
fedoraproject389_directory_server1.2.7.5
fedoraproject389_directory_server1.2.8
fedoraproject389_directory_server1.2.8.1
fedoraproject389_directory_server1.2.8.2
fedoraproject389_directory_server1.2.8.3
fedoraproject389_directory_server1.2.9.9
fedoraproject389_directory_server1.2.10

References

CWEs

CWE-264

Verify integrity in audit chain (admin only). AS-IS.