CVE-2014-0132

MediumCVSS 6.5/10Last modified Jun 17, 2026

Description

The SASL authentication functionality in 389 Directory Server before 1.2.11.26 allows remote authenticated users to connect as an arbitrary user and gain privileges via the authzid parameter in a SASL/GSSAPI bind.

Metrics

CVSS 2.0 6.5/10AV:N/AC:L/Au:S/C:P/I:P/A:P

Weakness enumeration

CWE-287

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

http://rhn.redhat.com/errata/RHSA-2014-0292.html
http://secunia.com/advisories/57412Vendor Advisory
http://secunia.com/advisories/57427Vendor Advisory
https://fedorahosted.org/389/changeset/76acff12a86110d4165f94e2cba13ef5c7ebc38a/Exploit
https://fedorahosted.org/389/ticket/47739Patch
http://rhn.redhat.com/errata/RHSA-2014-0292.html
http://secunia.com/advisories/57412Vendor Advisory
http://secunia.com/advisories/57427Vendor Advisory
https://fedorahosted.org/389/changeset/76acff12a86110d4165f94e2cba13ef5c7ebc38a/Exploit
https://fedorahosted.org/389/ticket/47739Patch

Timeline

Published: Mar 18, 2014
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2014

CVE-2014-01337.5Heap-based buffer overflow in the SPDY implementation in nginx 1.3.15 before 1.4.7 and 1.5.x before 1.5.12 allows remote attackers to execut CVE-2014-01343.5The instance rescue mode in OpenStack Compute (Nova) 2013.2 before 2013.2.3 and Icehouse before 2014.1, when using libvirt to spawn images a CVE-2014-01351.9Kafo before 0.3.17 and 0.4.x before 0.5.2, as used by Foreman, uses world-readable permissions for default_values.yaml, which allows local u CVE-2014-01365.0The (1) get and (2) log methods in the AgentController in Red Hat CloudForms 3.0 Management Engine (CFME) 5.x allow remote attackers to inse CVE-2014-01376.5SQL injection vulnerability in the saved_report_delete action in the ReportController in Red Hat CloudForms Management Engine (CFME) before CVE-2014-01386.4The default configuration in cURL and libcurl 7.10.6 before 7.36.0 re-uses (1) SCP, (2) SFTP, (3) POP3, (4) POP3S, (5) IMAP, (6) IMAPS, (7) CVE-2014-01395.8cURL and libcurl 7.1 before 7.36.0, when using the OpenSSL, axtls, qsossl or gskit libraries for TLS, recognize a wildcard IP address in the CVE-2014-01404.0Red Hat CloudForms 3.1 Management Engine (CFME) before 5.3 allows remote authenticated users to access sensitive controllers and actions via CVE-2014-01416.1Cross-site scripting (XSS) vulnerability in Red Hat Satellite 6.0.3.CVE-2014-01425.5QEMU, possibly before 2.0.0, allows local users to cause a denial of service (divide-by-zero error and crash) via a zero value in the (1) tr CVE-2014-01437.0Multiple integer overflows in the block drivers in QEMU, possibly before 2.0.0, allow local users to cause a denial of service (crash) via a CVE-2014-01448.6QEMU before 2.0.0 block drivers for CLOOP, QCOW2 version 2 and various other image formats are vulnerable to potential memory corruptions, i