Test ID:	1.3.6.1.4.1.25623.1.0.891483
Category:	Debian Local Security Checks
Title:	Debian: Security Advisory (DLA-1483-1)
Summary:	The remote host is missing an update for the Debian '389-ds-base' package(s) announced via the DLA-1483-1 advisory.
Description:	Summary: The remote host is missing an update for the Debian '389-ds-base' package(s) announced via the DLA-1483-1 advisory. Vulnerability Insight: CVE-2018-10871 By default nsslapd-unhashed-pw-switch was set to on. So a copy of the unhashed password was kept in modifiers and was possibly logged in changelog and retroCL. Unless it is used by some plugin it does not require to keep unhashed passwords. The nsslapd-unhashed-pw-switch option is now off by default. CVE-2018-10935 It was discovered that any authenticated user doing a search using ldapsearch with extended controls for server side sorting could bring down the LDAP server itself. The fix is to check if we are able to index the provided value. If we are not, then slapd_qsort returns an error (LDAP_OPERATION_ERROR). For Debian 8 Jessie, these problems have been fixed in version 1.3.3.5-4+deb8u2. We recommend that you upgrade your 389-ds-base packages. Further information about Debian LTS security advisories, how to apply these updates to your system and frequently asked questions can be found at: [link moved to references] Affected Software/OS: '389-ds-base' package(s) on Debian 8. Solution: Please install the updated package(s). CVSS Score: 4.0 CVSS Vector: AV:N/AC:L/Au:S/C:N/I:N/A:P
Cross-Ref:	Common Vulnerability Exposure (CVE) ID: CVE-2018-10871 https://lists.debian.org/debian-lts-announce/2018/08/msg00032.html RedHat Security Advisories: RHSA-2019:3401 https://access.redhat.com/errata/RHSA-2019:3401 Common Vulnerability Exposure (CVE) ID: CVE-2018-10935 RedHat Security Advisories: RHSA-2018:2757 https://access.redhat.com/errata/RHSA-2018:2757 SuSE Security Announcement: openSUSE-SU-2019:1397 (Google Search) http://lists.opensuse.org/opensuse-security-announce/2019-05/msg00033.html
Copyright	Copyright (C) 2018 Greenbone AG

This is only one of 145615 vulnerability tests in our test suite. Find out more about running a complete security audit. To run a free test of this vulnerability against your system, register below.