This vulnerability involves a stack buffer overflow in the 389 Directory Server component of Red Hat Directory Server 11. Specifically, the checkPrefix() function in pw.c copies an algorithm ID controlled by an attacker into a 256-byte stack buffer without proper bounds checking when parsing reversible-encrypted attribute values. An attacker with Directory Manager privileges can exploit this by submitting a crafted credential with an oversized algorithm ID, leading to a crash of the LDAP server. The FORTIFY_SOURCE compiler feature mitigates the risk of arbitrary code execution, restricting the impact to denial of service. The vulnerability requires high privileges (Directory Manager) and does not affect confidentiality or integrity, only availability.

The impact of this vulnerability is denial of service (DoS) due to a stack buffer overflow that crashes the LDAP server. There is no impact on confidentiality or integrity. The vulnerability requires Directory Manager privileges to exploit, and user interaction is not required. The FORTIFY_SOURCE mitigation prevents code execution, limiting the impact to availability only.

No official patch or fix has been confirmed yet. The vendor advisory recommends restricting Directory Manager access and monitoring cn=config attributes (nsDS5ReplicaCredentials, nsDS5ReplicaBootstrapCredentials) for abnormally long values. Additionally, LDAP administrative access should be restricted to management networks or localhost (LDAPI). These mitigations reduce the risk of exploitation by limiting access and detecting suspicious attribute values.