CVE-2022-0996

What it actually does

The vulnerability permits accounts with expired passwords to successfully authenticate and query the directory database, bypassing normal password expiration controls.

Why it matters to the business

Attackers can maintain access to sensitive directory information using outdated credentials, increasing the risk of data breaches and unauthorized access to user and system data across the organization.

How an attack unfolds

An attacker obtains or possesses credentials for an account whose password has expired. They use these credentials to bind to the 389 Directory Server, which incorrectly grants access instead of rejecting the expired password.

How to fix it

Apply patches from vendors once available for the 389 Directory Server to enforce proper password expiration checks during authentication. Monitor vendor advisories for updates to Red Hat 389 Directory Server, Fedora, and Red Hat Enterprise Linux packages.

How to confirm the fix worked

Test authentication with expired password accounts after updates to ensure access is denied. Review server logs for authentication attempts that should be rejected due to expiration.

Typical attack path

1. Identify exposed 389 Directory Server instances
2. Acquire credentials for accounts with expired passwords
3. Attempt authentication using the expired credentials
4. Access and query the directory database upon successful bypass

How to detect it

Examine directory server logs for successful authentications using accounts known to have expired passwords. Look for bind operations that succeed despite password expiration flags.

What your security team should do

• Prioritize patching the 389 Directory Server as updates become available given the public exploit maturity
• Audit accounts with expired passwords and enforce password changes
• Implement additional authentication controls like MFA where possible