CVE-2024-6237

What it actually does

The vulnerability permits an unauthenticated remote attacker to send a specially crafted extended search request that triggers a crash in the 389 Directory Server, resulting in a denial of service.

Why it matters to the business

Successful exploitation leads to unplanned downtime for directory services, potentially disrupting authentication and identity management operations across the organization.

How an attack unfolds

An attacker crafts and sends a specific extended search request to the 389 Directory Server without authentication, causing the server to crash systematically.

How to fix it

Upgrade affected 389 Directory Server packages to the listed fixed versions such as 5.14.16-1 on Debian 12/13 or the corresponding 5.4.0/5.15.0 kernel packages on Ubuntu 20.04 variants.

How to confirm the fix worked

Verify the installed version of the 389 Directory Server package matches or exceeds the fixed versions and test that the server remains stable under crafted search requests.

Typical attack path

1. Identify exposed 389 Directory Server instance
2. Craft malicious extended search request
3. Send request to trigger crash
4. Repeat to maintain denial of service

How to detect it

Review server logs for repeated failed or anomalous extended search requests leading to crashes; monitor process termination events related to the directory server.

What your security team should do

• Apply available updates to 389 Directory Server packages immediately
• Monitor for unusual search request patterns
• Implement network access controls to limit exposure