CyberRota Analysis
AI-GeneratedThe vulnerability affects the 389 Directory Server, where a flaw in SASL PLAIN authentication allows an attacker to exploit a stale identity from a previous failed bind attempt, granting unauthorized access to Directory Manager privileges. This can be achieved by first attempting a bind with incorrect credentials and then completing a successful anonymous bind on the same connection, potentially compromising sensitive directory data. Organizations using 389 Directory Server should prioritize patching this critical vulnerability to prevent unauthorized access and potential data breaches.
Original NVD Description
A flaw was found in 389 Directory Server. During SASL PLAIN authentication, a stale identity carried in a Cyrus SASL auxiliary property from a prior failed bind attempt can be installed on a connection following a subsequent, unrelated successful bind, regardless of which SASL mechanism completes that second bind. An attacker can send a SASL PLAIN bind as cn=Directory Manager with an incorrect password, then complete a SASL ANONYMOUS bind on the same connection, causing the server to grant Directory Manager authority without any valid credentials. A variant using a valid low-privileged account's own successful bind instead of an anonymous one is also possible.